CVE-2023-6019

🗓️ 16 Nov 2023 16:12:07Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 128 Views🌐 WEB

A command injection in Ray's cpu_profile URL parameter allows remote code execution without authentication

Reporter	Title	Published	Views	Family All 35
0day.today	Ray OS v2.6.3 - Command Injection Exploit	12 Apr 202400:00	–	zdt
0day.today	Ray cpu_profile Command Injection Exploit	27 Aug 202400:00	–	zdt
GithubExploit	Exploit for OS Command Injection in Ray_Project Ray	21 Apr 202414:30	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Ray_Project Ray	28 Oct 202520:04	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Ray_Project Ray	10 Apr 202409:24	–	githubexploit
Circl	CVE-2023-6019	18 Mar 202410:01	–	circl
CNNVD	Ray Operating System Command Injection Vulnerability	16 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-6019 Ray Command Injection in cpu_profile Parameter	16 Nov 202316:12	–	cvelist
Exploit DB	Ray OS v2.6.3 - Command Injection RCE(Unauthorized)	12 Apr 202400:00	–	exploitdb
Github Security Blog	Ray Path Traversal vulnerability	16 Nov 202318:30	–	github

NVD

Node

ray_project rayMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "ray-project/ray",
    "vendor": "ray-project",
    "versions": [
      {
        "lessThanOrEqual": "latest",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe

Parameter	Position	Path	Description	CWE
format	query param	worker/cpu_profile	Ray cpu_profile format parameter vulnerable to command injection	CWE-78

21 Nov 2024 08:42Current

8.9High risk

Vulners AI Score8.9

CVSS 3.19.8

EPSS0.88771

CWE-78