.. / CVE-2023-48023

• SSRF
• Nuclei
• Web

Exploit for Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery (CVE-2023-48023)

Description:

The Ray Dashboard API is affected by a Server-Side Request Forgery (SSRF) vulnerability in the url parameter of the /log_proxy API endpoint. The API does not perform sufficient input validation within the affected parameter and any HTTP or HTTPS URLs are accepted as valid.

Nuclei Template

View the template here CVE-2023-48023.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-48023.yaml

References: