Opening SecureFlowRay Browser DNS Rebinding to Unauthenticated Jobs API RCE
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

Ray Project aidefend-sf0030

Ray Browser DNS Rebinding to Unauthenticated Jobs API RCE

  • AI Infrastructure
  • System Compromise & RCE

A developer using Firefox or Safari visits attacker content while Ray before 2.52.0 exposes its Dashboard on port 8265. DNS rebinding reaches the local or private endpoint, a custom User-Agent bypasses Ray's browser POST guard, and the page submits an unauthenticated job whose command Ray executes.

Mapped threat techniques

  • AML.T0011.003 User Execution: Malicious Link
  • AML.T0107 Exploitation for Defense Evasion
  • AML.T0050 Command and Scripting Interpreter

Source

Updated