CVE-2023-48022: Ray Package Arbitrary Code Execution via Job Submission API
Summary
CVE-2023-48022: Ray has arbitrary code execution via jobs submission API. Affects ray versions < 2.49.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ray is an open-source framework designed for building and running distributed applications. It provides a simple interface for parallel and distributed computing, enabling developers to scale their applications effortlessly. However, Ray's job submission API has a critical vulnerability that allows remote attackers to execute arbitrary code, posing significant security risks if used in uncontrolled environments.
Vulnerability Detail
The vulnerability arises from the job submission API in Anyscale Ray, which allows remote attackers to submit jobs that can execute arbitrary code on the server. This flaw is particularly concerning as it can lead to unauthorized access and control over the affected system. The vendor has indicated that Ray is intended for use only within strictly controlled network environments, which may not mitigate the risks associated with this vulnerability in less secure settings.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the job submission API by implementing network security measures, such as firewalls or VPNs, to limit exposure to trusted networks only.
Conclusion
CVE-2023-48022 represents a significant security risk for users of the Ray package due to its arbitrary code execution vulnerability. It is crucial for users to update to the latest version to protect their systems and data. Implementing network security measures can provide temporary relief until an update can be applied.
See every vulnerability recorded for ray →
FAQ
CVE-2023-48022 is a critical vulnerability in the Ray package that allows remote attackers to execute arbitrary code via the job submission API.
The affected versions of Ray range from 0 to 2.49.2. Users should upgrade to version 2.49.3 or later to mitigate the vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2023-48022 is 9.8, indicating a critical level of severity.
If immediate updates are not possible, implement network security measures to restrict access to the job submission API, ensuring it is only accessible within a controlled environment.
Related vulnerabilities
Recent vulnerabilities recorded for ray.
