Rule Document 1:66983

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Ray Project Ray Dashboard browser-based remote code execution attempt

Rule Explanation

This rule looks for a set of characteristic strings associated with a malicious JavaScript job submission script in the HTTP response body on the Ray Dashboard port. Successful exploitation enables an attacker‑controlled browser to submit a crafted job to the Ray Dashboard, leading to remote code execution on the host running the service.

What To Look For

This rule fires on attempts to deliver a browser-based remote code execution payload targeting Ray Dashboard clients.

Known Usage

Attacks/Scans seen in the wild

False Positives

Known false positives, with the described conditions

Legitimate or custom JavaScript that constructs a Ray /api/jobs POST request and explicitly sets User-Agent in the same ordered structure could potentially match.

Contributors

Cisco Talos Intelligence Group

Rule Groups

MITRE::ATT&CK Framework::Enterprise::Execution::User Execution::Malicious File

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.

MITRE::ATT&CK Framework::Enterprise::Initial Access::Drive-by Compromise

Rule Categories::Server::Web Applications

Vulnerability::Severity::Critical

Vulnerability::Severity::High

CVE

CVE-2025-62593

Additional Links

github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v

Rule Vulnerability

Command Injection

Command Injection attacks target applications that allow unsafe user-supplied input. Attackers transmit this input via forms, cookies, HTTP headers, etc. and exploit the applications permissions to execute system commands without injecting code.

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.

CVE-2025-62593

Loading description