Ray Dashboard CPU Profile Command Injection

Small standalone Python PoC repository for CVE-2023-6019 targeting Anyscale Ray / Ray Dashboard. Repository contains three files: LICENSE, README.md, and a single executable exploit script, poc.py. The script uses argparse for CLI handling and requests for HTTP interaction. Its flow is straightforward: main() parses target and callback parameters, check_version() sends an HTTP GET to /api/version to retrieve the Ray and API versions and compares them against a hardcoded vulnerable-version list, then send_payload() issues an HTTP POST to /api/jobs/ with a JSON body containing an entrypoint command. That entrypoint is a bash reverse shell using /dev/tcp to connect back to the attacker-controlled host and port. The exploit therefore provides unauthenticated remote code execution with a basic hardcoded payload rather than a flexible framework-integrated module. No persistence, privilege escalation, lateral movement, or evasion features are present. The README documents the vulnerability, usage, expected output, and mitigation guidance, and matches the behavior of the code.

This repository is a comprehensive lab environment for demonstrating and testing exploitation and mitigation of CVE-2023-6019, a command injection vulnerability in the Ray Dashboard. The structure includes Dockerized services: a vulnerable Ray Dashboard (simulated), a monitoring service that logs and simulates the vulnerable endpoint, a WAF (Web Application Firewall) for mitigation, and a frontend dashboard for user interaction and statistics. The main exploit capability is to send crafted payloads to the /api/launch_profiling endpoint, attempting command injection via the cpu_profile parameter. The testing/exploit_test.py script automates sending various payloads to different endpoints (direct, monitor, WAF) and reports whether the payloads are blocked or allowed. The monitoring and WAF services include detection logic for suspicious patterns and log all suspicious requests. The repository is well-structured for both offensive (exploit) and defensive (mitigation) testing, making it suitable for security research and demonstration purposes.

This repository contains a single Metasploit module (modules/exploits/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.rb) targeting CVE-2023-6019, a command injection vulnerability in the Ray distributed computing framework (versions 2.2.0 to 2.6.3) on Linux. The exploit leverages the /worker/cpu_profile HTTP endpoint, injecting commands via the 'format' GET parameter. The module first checks the Ray version and retrieves node information via the /api/version and /nodes?view=summary endpoints. It then exploits the vulnerability to execute arbitrary commands or staged payloads (such as a reverse shell) on the target system. The exploit is operational and provides remote code execution capabilities, with payload delivery handled via standard Metasploit mechanisms. The code is written in Ruby and is structured as a typical Metasploit exploit module.

This repository contains a Python proof-of-concept exploit for CVE-2023-6019. The main file, CVE-2023-6019.py, constructs a reverse shell payload in Python, encodes it in base64, and injects it into a vulnerable HTTP endpoint on the target system. The exploit requires the attacker to specify the target's IP and port, as well as the attacker's own listener IP and port for the reverse shell connection. The payload, when executed on the target, connects back to the attacker's listener and spawns a bash shell, granting remote command execution. The repository also includes a README with usage instructions. The exploit is operational and demonstrates remote code execution via a network-accessible HTTP endpoint.