erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: March 26, 2024

1 editorial brief, 1 known exploited (cisa kev) addition and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Check exposure: ShadowRay. Anyone running Ray clusters (self-managed, on Kubernetes/KubeRay or on cloud VMs) whose head node ports, especially the dashboard/Jobs port 8265, are reachable from the internet or other untrusted networks.
  • Do you run any of these? Microsoft SharePoint Server. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-04-16.
  • PyPI: 1 critical advisory (Lektor). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Misconfiguration · CVE-2023-48022

ShadowRay: Exposed Ray Clusters Hijacked (CVE-2023-48022)

There is no patch to install: if any Ray dashboard, Jobs or Client port is reachable from an untrusted network, anyone who can reach it can run code on your cluster.

Must act: Anyone running Ray clusters (self-managed, on Kubernetes/KubeRay or on cloud VMs) whose head node ports, especially the dashboard/Jobs port 8265, are reachable from the internet or other untrusted networks.

Can relax: Teams whose Ray clusters are only reachable from a private, controlled network or through an authenticating proxy or SSH tunnel, and managed-service users whose provider handles isolation.

  1. Inventory Ray head nodes and confirm that ports such as 8265 are not reachable from the internet (security groups, firewall rules, Kubernetes Services).
  2. Do not bind Ray to 0.0.0.0 on public interfaces; use a private interface or network.
  3. If remote access is needed, put the dashboard behind an authenticating proxy, VPN or SSH tunnel.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2023-24955Microsoft SharePoint Server
Microsoft SharePoint Server Code Injection Vulnerability Ransomware		2024-04-16

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 1

Check: pip-audit (or: pip show <package>)