Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)

QFinch assessment

Ray’s dashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. Details - Middleware: python/ray/dashboard/httpserverhead.pygetbrowsersnopostputmiddleware only checks POST/PUT via isbrowserrequest (UA/Origin/Sec-Fetch heuristics). DELETE is not gated. - Endpoints lacking browser protection/auth by default: - Dashboard token auth is optional and off by default; binding to 0.0.0.0 is common for remote access. PoC Prereqs: dashboard reachable (e.g., ray start --head --dashboard-host=0.0.0.0), no token auth. 1. Start Serve (or have jobs present). 2. From any browser-reachable origin (DNS rebinding or same-LAN page), issue a DELETE fetch: 3) Similarly, delete jobs: fetch("http://<dashboard-host>:8265/api/jobs/<joborsubmissionid>", { method: "DELETE" }); fetch("http://<dashboard-agent>:52365/api/jobagent/jobs/<joborsubmissionid>", { method: "DELETE" }); Browsers will send the Mozilla UA and Origin/Sec-Fetch headers, but DELETE is not blocked by the middleware, so the requests succeed. Impact - Availability loss: Serve shutdown; job deletion. Triggerable via drive-by browser requests if the dashboard/agent ports are reachable and auth is disabled (default). - No code execution from this vector, but breaks isolation/trust assumptions for “developer-only” endpoints.

Potential impact

- Availability loss: Serve shutdown; job deletion. Triggerable via drive-by browser requests if the dashboard/agent ports are reachable and auth is disabled (default). - No code execution from this vector, but breaks isolation/trust assumptions for “developer-only” endpoints.

Technical context

- Middleware: python/ray/dashboard/httpserverhead.pygetbrowsersnopostputmiddleware only checks POST/PUT via isbrowserrequest (UA/Origin/Sec-Fetch heuristics). DELETE is not gated. - Endpoints lacking browser protection/auth by default: - Dashboard token auth is optional and off by default; binding to 0.0.0.0 is common for remote access. PoC Prereqs: dashboard reachable (e.g., ray start --head --dashboard-host=0.0.0.0), no token auth. 1. Start Serve (or have jobs present). 2. From any browser-reachable origin (DNS rebinding or same-LAN page), issue a DELETE fetch: 3) Similarly, delete jobs: fetch("http://<dashboard-host>:8265/api/jobs/<joborsubmissionid>", { method: "DELETE" }); fetch("http://<dashboard-agent>:52365/api/jobagent/jobs/<joborsubmissionid>", { method: "DELETE" }); Browsers will send the Mozilla UA and Origin/Sec-Fetch headers, but DELETE is not blocked by the middleware, so the requests succeed. Impact - Availability loss: Serve shutdown; job deletion. Triggerable via drive-by browser requests if the dashboard/agent ports are reachable and auth is disabled (default). - No code execution from this vector, but breaks isolation/trust assumptions for “developer-only” endpoints.