CVE-2025-26360

Executive Summary

CVE-2025-26360 is a critical authentication bypass vulnerability affecting Q-Free MaxTime versions up to and including 2.11.0. The flaw resides in the maxprofile/persistance/routes.lua file, where a missing authentication check (CWE-306) allows an unauthenticated remote attacker to delete dashboards via crafted HTTP requests. This vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation probability at this time. No public proof-of-concept or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is considered Medium due to the low complexity and no required privileges, but the impact is limited to integrity (deletion of dashboards) without affecting confidentiality or availability.

Deep Dive & Mechanics

The vulnerability is located in the maxprofile/persistance/routes.lua file of Q-Free MaxTime. The application fails to enforce authentication checks on the endpoint responsible for deleting dashboards. An attacker can send a crafted HTTP request (likely a DELETE or POST request) to the vulnerable endpoint without any session token or credentials. The server processes the request and deletes the specified dashboard, leading to data loss and potential operational disruption.

The root cause is a missing authentication middleware or check in the route handler. The code likely does not verify the user's identity or permissions before executing the delete operation.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

-- Vulnerable code in maxprofile/persistance/routes.lua
app.delete("/dashboard/:id", function(req, res)
    -- Missing authentication check
    local dashboardId = req.params.id
    deleteDashboard(dashboardId)
    res.status(200).send("Dashboard deleted")
end)

A patched version would include authentication verification:

-- Patched code
app.delete("/dashboard/:id", function(req, res)
    -- Authentication check
    if not isAuthenticated(req) then
        res.status(401).send("Unauthorized")
        return
    end
    local dashboardId = req.params.id
    deleteDashboard(dashboardId)
    res.status(200).send("Dashboard deleted")
end)

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Q-Free MaxTime version 2.11.0 in a controlled environment.
2. Identify the vulnerable endpoint (likely /dashboard/{id} or similar).
3. Use a tool like curl or Burp Suite to send a crafted request.

Exploitation Steps:

# Example request to delete a dashboard with ID 123
curl -X DELETE http://target:port/maxprofile/persistance/dashboard/123

Expected Outcome: The dashboard with ID 123 is deleted without authentication.

Blue Team

Detection:

• Monitor for HTTP DELETE requests to /maxprofile/persistance/dashboard/ without prior authentication.
• Look for anomalous spikes in dashboard deletion events.
• Check logs for requests from unknown IPs to the vulnerable endpoint.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block unauthenticated DELETE requests to the vulnerable path.
• Apply network segmentation to restrict access to the MaxTime application.
• Monitor for any unauthorized changes in dashboard configurations.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP DELETE requests to /maxprofile/persistance/dashboard/ from unauthenticated sources.
  • Repeated 200 OK responses to such requests without prior login.
• File IOCs:
  • Unexpected deletion of dashboard configuration files in the MaxTime data directory.
• Log IOCs:
  • Log entries showing dashboard deletion events without associated user authentication.

Detection Engineering

YARA Rule

rule CVE_2025_26360_QFree_MaxTime {
    meta:
        description = "Detects exploitation attempts for CVE-2025-26360"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26360"
    strings:
        $s1 = "DELETE /maxprofile/persistance/dashboard/" ascii wide nocase
        $s2 = "HTTP/1.1" ascii wide
    condition:
        any of ($s1*) and $s2
}

Sigma Rule

title: CVE-2025-26360 - Unauthenticated Dashboard Deletion
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated HTTP DELETE requests to the vulnerable endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26360
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'DELETE'
        cs-uri-stem: '/maxprofile/persistance/dashboard/*'
    condition: selection
falsepositives:
    - Legitimate authenticated dashboard deletions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26360 - Unauthenticated Dashboard Deletion"; flow:to_server; content:"DELETE"; http_method; content:"/maxprofile/persistance/dashboard/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected Q-Free MaxTime instances from untrusted networks.
2. Implement a WAF rule to block unauthenticated DELETE requests to /maxprofile/persistance/dashboard/.
3. Monitor logs for any suspicious activity related to dashboard deletion.

Long-term Fix:

• Apply authentication checks to all critical functions in maxprofile/persistance/routes.lua.
• Contact Q-Free for an official patch or upgrade to a patched version when available.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• If patching is not possible, restrict access to the MaxTime application using network ACLs or VPN.

Valters IT