CVE-2025-62593: Ray Project Code Injection — DNS Rebinding Enables Unauthenticated RCE

Executive Summary

A critical remote code execution (RCE) vulnerability in Anyscale Ray — the widely deployed AI compute framework — allows an unauthenticated attacker to submit arbitrary jobs to a Ray cluster by chaining a DNS rebinding attack with a trivially bypassable User-Agent header guard. Tracked as CVE-2025-62593, the flaw affects all Ray versions prior to 2.52.0, which ships the fix.

A public proof-of-concept (PoC) exploit is available, making rapid patching critical for any organization running Ray in developer or shared environments.

Vulnerability Overview

Root Cause: Intentional No-Auth + Trivial Guard

Ray's development dashboard deliberately exposes unauthenticated API endpoints — including /api/jobs and /api/job_agent/jobs/ — by design. The Ray team's intended stance is that the dashboard should only be reachable on trusted networks.

The only protection in place was a User-Agent header check requiring the value to begin with "Mozilla". This check is trivially bypassable because the Fetch API specification allows modification of the User-Agent header.

Attack Chain

When combined with a DNS rebinding attack, an attacker can trick a developer's browser (particularly Firefox or Safari) into issuing cross-origin requests to the local Ray dashboard:

1. Developer visits malicious website or clicks malvertising
2. Attacker's domain initially resolves to attacker's server
3. DNS TTL expires; domain rebinds to 127.0.0.1 (Ray dashboard)
4. Browser's same-origin policy no longer blocks cross-origin requests
5. Attacker's JavaScript submits crafted job to /api/jobs with "Mozilla" User-Agent
6. Ray executes the job in the context of the Ray worker process
7. RCE achieved — arbitrary code runs on the developer's machine or cluster

This attack is especially dangerous because AI/ML engineers routinely run Ray locally or on shared developer clusters, where the dashboard is accessible on internal networks — exactly the environment an attacker can reach via DNS rebinding.

Technical Details

Vulnerable Endpoints

User-Agent Bypass

The sole protection was a server-side check for:

User-Agent: Mozilla*

The Fetch API spec permits setting this header, making the bypass a single line:

fetch('http://localhost:8265/api/jobs', {
  method: 'POST',
  headers: { 'User-Agent': 'Mozilla/5.0', 'Content-Type': 'application/json' },
  body: JSON.stringify({ entrypoint: 'python -c "import os; os.system(\'malicious_command\')"' })
});

Fix in Ray 2.52.0

The fix commit (70e7c72780bdec075dba6cad1afe0832772bfe09) removes the User-Agent guard and implements proper origin validation to prevent DNS rebinding, alongside additional authentication controls on the job submission API.

Remediation

Immediate Actions

1. Upgrade to Ray 2.52.0 — the only complete fix
2. Network isolation — Ray dashboards should never be accessible from untrusted networks; enforce this at the firewall level
3. Audit running clusters — check for unauthorized job submissions in Ray logs
4. Browser-level mitigation — Chrome's planned DNS rebinding protection mitigates this partially, but do not rely on client-side controls

If Immediate Patching Is Not Possible

• Block external access to Ray dashboard ports (default: 8265) at the network perimeter
• Use a VPN or zero-trust access proxy to gate all Ray dashboard access
• Disable Ray dashboard entirely if not needed: ray start --no-redirect-output --disable-usage-stats

Who Is Affected

Ray is used extensively in AI/ML infrastructure by organizations training and serving large-scale models. Common deployment patterns that are at risk include:

• Developer laptops running ray start locally with open dashboard
• Shared GPU clusters with the Ray dashboard on an internal network
• Kubernetes deployments where the dashboard service is accessible within the cluster network
• Jupyter/notebook environments where users open the Ray dashboard in a browser while on shared Wi-Fi

The availability of a public PoC on GitHub (B1ack4sh/Blackash-CVE-2025-62593) means opportunistic exploitation is now feasible for any attacker who can reach a Ray instance.

Key Takeaways

1. Upgrade to Ray 2.52.0 immediately — no authentication workaround exists in prior versions
2. DNS rebinding + trivial User-Agent bypass = no-auth RCE for any attacker reachable from a developer's browser
3. AI/ML infrastructure is increasingly targeted — Ray, MLflow, and similar frameworks often run with permissive access assumptions
4. Network isolation is not sufficient alone — DNS rebinding attacks cross network boundaries via the browser

References

• GitHub Advisory GHSA-q279-jhrf-cc6v
• Ray 2.52.0 Release Notes
• Fix Commit 70e7c72
• Public PoC — Blackash-CVE-2025-62593