Exploit for Server-Side Request Forgery in Anyscale Ray

🗓️ 10 Jan 2024 06:26:01Reported by 0x656565Type

Exploit for Server-Side Request Forgery in Anyscale Ray CVE-2023-48022, modified from Bishop Fox work. Use jobs.py to set IP and port, and malicious.py for payload. Requires installation of ray library.

Reporter	Title	Published	Views	Family All 57
0day.today	Ray Agent Job Remote Code Execution Exploit	27 Aug 202400:00	–	zdt
GithubExploit	Exploit for Server-Side Request Forgery in Anyscale Ray	29 Mar 202409:54	–	githubexploit
BDU FSTEC	The vulnerability of the AI application scaling framework and Python Ray, related to an incorrect path name limitation for the restricted access catalog, allows attackers to read arbitrary files.	3 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the dashboard component of the application scaling framework for AI and Python Ray applications, which allows a hacker to execute arbitrary commands.	3 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AI application scaling framework and Python Ray, related to deficiencies in the authentication process, allows attackers to read arbitrary files from the /static/ directory.	3 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the client framework for AI and Python Ray application scaling application programming interface allows a attacker to execute arbitrary commands.	6 Apr 202400:00	–	bdu_fstec
Chainguard	CVE-2023-48022 vulnerabilities	7 Jan 202601:30	–	cgr
Circl	CVE-2023-48022	17 Dec 202316:42	–	circl
CNNVD	Ray Code Issues Vulnerabilities	28 Nov 202300:00	–	cnnvd
CVE	CVE-2023-48022	28 Nov 202300:00	–	cve

28 Mar 2024 17:24Current

8.8High risk

Vulners AI Score8.8

CVSS 3.19.8

EPSS0.92192

SSVC