CVE-2023-48022 PoC — Ray 安全漏洞

Source

https://github.com/0x656565/CVE-2023-48022

Associated Vulnerability

Title: Ray 安全漏洞 (CVE-2023-48022)
Description:Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment. (Also, within that environment, customers at version 2.52.0 and later can choose to use token authentication.)

Description

CVE-2023-48022 exploit modified from Bishop Fox work

Readme

# CVE-2023-48022
CVE-2023-48022 exploit modified from Bishop Fox work
## How to use
set ip and port in jobs.py  
set payload in malicious.py    
`$ pip install ray`  
`$ python3 jobs.py`

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →