CVE-2023-48022: Ray Package Arbitrary Code Execution via Job Submission API
Summary
CVE-2023-48022: Ray has arbitrary code execution via jobs submission API. Affects ray versions < 2.49.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ray is an open-source framework designed for building and running distributed applications. It provides a simple interface for parallel and distributed computing, enabling users to scale their Python applications effortlessly. However, Ray's job submission API has a significant vulnerability that allows remote attackers to execute arbitrary code, raising serious security concerns.
Vulnerability Detail
The vulnerability arises from the job submission API in Anyscale Ray, which permits remote attackers to execute arbitrary code. This issue is particularly critical as it can lead to unauthorized access and control over the affected systems. The vendor has stated that Ray is intended for use only within strictly controlled network environments, which may not mitigate the risk for all users. The CVSS score of this vulnerability is 9.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the job submission API to trusted networks only. Implementing network security measures such as firewalls can help mitigate the risk of unauthorized access.
Conclusion
CVE-2023-48022 represents a critical vulnerability in the Ray package, allowing arbitrary code execution via the job submission API. Users are strongly encouraged to update to the latest version of Ray and implement security measures to protect their systems.
See every vulnerability recorded for ray →
FAQ
CVE-2023-48022 is a vulnerability in the Ray package that allows remote attackers to execute arbitrary code through the job submission API.
The vulnerability can lead to unauthorized code execution, potentially compromising the security and integrity of the affected systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, users are advised to update the Ray package to the latest version to mitigate this vulnerability.
If immediate updates are not possible, restrict access to the job submission API and implement network security measures to reduce exposure.
Related vulnerabilities
Recent vulnerabilities recorded for ray.
