Ray Jobs API Unauthenticated RCE (ShadowRay)
- Product
- Anyscale Ray
- CVE
- CVE-2023-48022
- Disclosed
- 2023-11-28
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- Ray 2.6.3, 2.8.0 and other versions without token authentication (disputed by vendor)
- Fixed
- No code fix; token authentication available from Ray 2.52.0
Summary
Ray's dashboard exposes a Jobs API that runs arbitrary shell commands, and it has no authentication by default. Anyscale disputes the CVE as by-design, but Oligo's 'ShadowRay' research found thousands of exposed clusters actively exploited for cryptomining and credential theft.
Root cause
The Ray dashboard (default port 8265) offers a REST API at /api/jobs/ whose 'entrypoint' field is a shell command executed on the cluster. Ray historically shipped no authentication and assumed a trusted network, so any network-reachable dashboard yields command execution on the head node.
Impact
Unauthenticated code execution across the cluster, often with GPU access, cloud credentials and model weights.
Public PoC
curl -X POST http://127.0.0.1:8265/api/jobs/ \
-H "Content-Type: application/json" \
-d '{"entrypoint": "cat /etc/passwd"}'Source: Bishop Fox advisory
Detection
Scan for exposed port 8265 and unexpected POSTs to /api/jobs/. Nuclei has templates for exposed Ray dashboards; review job history for unknown entrypoints.
Mitigation
Never expose Ray dashboards or GCS ports to untrusted networks; enable token authentication (Ray 2.52.0+) and firewall the cluster.