CVE-2025-26354

Executive Summary

CVE-2025-26354 is a critical path traversal vulnerability (CWE-35) discovered in Q-Free MaxTime, a traffic management system, affecting versions up to and including 2.11.0. The flaw resides in the maxtime/api/database/database.lua file, specifically within the copy endpoint. An authenticated remote attacker can exploit this vulnerability to overwrite sensitive files on the server by crafting malicious HTTP requests. With a CVSS score of 7.2, this vulnerability poses a significant risk to the integrity of the system, potentially allowing an attacker to corrupt configuration files, replace binaries, or disrupt traffic management operations. No public proof-of-concept (PoC) or exploit code is currently available, and no official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary traffic management system (Q-Free MaxTime). The risk is primarily to organizations that have deployed this system in their infrastructure, as the attack vector requires prior authentication.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low – An attacker must have valid credentials to the system.
• User Interaction (UI): None – No user action is needed for exploitation.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): High – An attacker could read sensitive files.
• Integrity (I): High – An attacker can overwrite critical files.
• Availability (A): None – The vulnerability does not directly impact availability.

Threat Level: High. The combination of network exploitability, low complexity, and high integrity impact makes this a serious threat, especially for critical infrastructure environments where Q-Free MaxTime is deployed.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the copy endpoint of the maxtime/api/database/database.lua Lua script. The endpoint is designed to copy database files, but it fails to properly sanitize user-supplied input for the source and destination paths. An authenticated attacker can inject path traversal sequences (e.g., ../) to escape the intended database directory and access arbitrary files on the filesystem.

Mechanism:

1. The attacker authenticates to the Q-Free MaxTime web interface.
2. The attacker sends a crafted HTTP request to the /maxtime/api/database/database.lua endpoint with a copy action.
3. The request includes parameters for source and destination paths, such as:
   • source=../../etc/passwd
   • destination=../../tmp/overwritten_file
4. The server, lacking proper input validation, processes the request and copies the source file to the destination, overwriting the target file.

Impact: An attacker can overwrite critical system files (e.g., configuration files, binaries, or scripts) to achieve persistent access, escalate privileges, or disrupt the traffic management system.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the copy function of database.lua. A patched version would include proper path validation.

Vulnerable Code (Conceptual):

-- Vulnerable: No path sanitization
function copy_file(source, destination)
    local src_path = source
    local dst_path = destination
    -- Directly uses user input without validation
    os.execute("cp " .. src_path .. " " .. dst_path)
end

Patched Code (Conceptual):

-- Patched: Sanitize paths to prevent traversal
function sanitize_path(input_path)
    -- Remove any path traversal sequences
    local sanitized = input_path:gsub("%.%.%/?", "")
    -- Ensure path is within allowed directory
    if not sanitized:match("^/allowed/directory/") then
        return nil
    end
    return sanitized
end

function copy_file(source, destination)
    local src_path = sanitize_path(source)
    local dst_path = sanitize_path(destination)
    if not src_path or not dst_path then
        return "Invalid path"
    end
    os.execute("cp " .. src_path .. " " .. dst_path)
end

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials for the Q-Free MaxTime system.
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Authenticate to the Q-Free MaxTime web interface (e.g., via HTTP POST to /login).
2. Obtain a session cookie or token.
3. Craft an HTTP request to the copy endpoint with path traversal payloads.

Example HTTP Request (using curl):

curl -X POST "http://target.com/maxtime/api/database/database.lua" \
  -H "Cookie: session=valid_session_cookie" \
  -d "action=copy&source=../../etc/passwd&destination=../../tmp/overwritten_file"

Expected Outcome: The /etc/passwd file is copied to /tmp/overwritten_file, demonstrating file read capability. For file overwrite, an attacker could target configuration files like /etc/shadow or application binaries.

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP requests to /maxtime/api/database/database.lua for unusual parameters containing ../ or ..\\.
• Alert on any file copy operations outside the expected database directory.

Mitigation:

• Implement strict input validation and sanitization for all file paths.
• Use a whitelist of allowed directories for file operations.
• Apply the principle of least privilege to the web application user.
• Deploy a Web Application Firewall (WAF) with rules to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /maxtime/api/database/database.lua with parameters containing ../ or ..\\.
  • Unusual file copy operations detected in system logs (e.g., cp commands with unexpected paths).
• File System IOCs:
  • Unexpected files in /tmp/ or other world-writable directories.
  • Modified configuration files (e.g., /etc/passwd, /etc/shadow, application configs).
• Log IOCs:
  • Web server logs showing requests with path traversal patterns.
  • System logs showing cp commands executed by the web application user.

Detection Engineering

YARA Rule

rule CVE_2025_26354_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Q-Free MaxTime database.lua copy endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-26354"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "database.lua"
        $action = "copy"
    condition:
        $endpoint and $action and (#traversal1 > 0 or #traversal2 > 0)
}

Sigma Rule

title: CVE-2025-26354 Path Traversal in Q-Free MaxTime
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in HTTP requests to Q-Free MaxTime database.lua copy endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "database.lua"
            - "action=copy"
            - "../"
            - "..\\"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26354 Q-Free MaxTime Path Traversal Attempt"; flow:to_server,established; content:"database.lua"; http_uri; content:"action=copy"; http_client_body; pcre:"/(\.\.\/|\.\.\\)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the System: If possible, disconnect the Q-Free MaxTime system from the network or restrict access to trusted IPs only.
2. Apply Workaround: Manually patch the database.lua file to sanitize input paths (see patched code example above).
3. Monitor Logs: Actively monitor web server and system logs for signs of exploitation.

Long-Term Remediation:

• Vendor Patch: Await an official patch from Q-Free. Contact the vendor for updates.
• Upgrade: If a patched version becomes available, upgrade immediately.
• Code Review: Conduct a security audit of the entire application to identify similar vulnerabilities.
• WAF Deployment: Implement a Web Application Firewall with rules to block path traversal attacks.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division.