CVE-2023-48023: 
Homebrew vulnerability analysis and mitigation

Anyscale Ray versions 2.6.3 and 2.8.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the /log_proxy API endpoint. The vulnerability was discovered and reported by Bishop Fox, but is currently marked as disputed. The vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment (Bishop Fox Blog, Ray Security Docs).

The vulnerability exists in the url parameter of the /log_proxy API endpoint of the Ray Dashboard API. The API does not perform sufficient input validation within the affected parameter, and any HTTP or HTTPS URLs are accepted as valid. The issue is exploitable without authentication and only requires network connectivity to the Ray Dashboard port (8265 by default). The vulnerability has been assigned a CVSS v3.1 base score of 9.1 CRITICAL with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (Bishop Fox Blog).

If exploited, the vulnerability could allow attackers to proxy any HTTP or HTTPS request through the API. In a typical cloud installation, attackers could potentially retrieve highly privileged IAM credentials required by Ray from the AWS metadata API. This could lead to unauthorized access to sensitive data and potential privilege escalation in cloud environments (Bishop Fox Blog).

Ray maintainers recommend running Ray within a secured, trusted environment and adding firewall rules or security groups to prevent unauthorized access. If the Ray Dashboard needs to be accessible, implement a proxy that adds an authorization layer to the Ray API when exposing it over the network. Users should avoid binding on 0.0.0.0 and instead use an IP of an explicit network interface within a trusted private VPC/VPN (Ray Security Docs).

The security community has expressed concern about this vulnerability being marked as disputed despite active exploitation in the wild. Oligo Security researchers have dubbed this vulnerability 'ShadowRay,' marking it as the first known instance of AI workloads being actively exploited through vulnerabilities in modern AI infrastructure (Oligo Security).