Vulnerability · Published Nov 16, 2023 · Assigned by @huntr_ai
CVE-2023-6021Ray Log File Local File Include
High 7.5
In plain English
A high-severity security flaw in ray-project/ray from ray-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 37.1% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | ray | 2.8.1 | GHSA-3pww-qvr8-6mhp |
| PyPI | ray | 2.8.1 | PYSEC-2026-515 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ray-project | ray-project/ray | unspecified – through latest |
Weakness: CWE-29 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N