CVE-2025-26368

Executive Summary

CVE-2025-26368 is a critical Missing Authorization vulnerability (CWE-862) in Q-Free MaxTime, a traffic management and tolling system. The flaw resides in the maxprofile/user-groups/routes.lua file, allowing an authenticated low-privileged attacker to delete arbitrary user groups via crafted HTTP requests. With a CVSS score of 8.1, this vulnerability poses a high risk to the integrity and availability of the system, potentially disrupting user management and access controls. No public proof-of-concept or patch is currently available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a low-privileged account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): High (H) – User groups can be deleted, altering system state.
• Availability (A): High (H) – Deletion of groups may cause service disruption.

Threat Level: High – Exploitation requires authentication but can lead to significant operational impact.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization checks. In maxprofile/user-groups/routes.lua, the endpoint responsible for deleting user groups does not verify whether the requesting user has the necessary administrative privileges. An authenticated attacker with a low-privileged session can send a DELETE request to the vulnerable endpoint, and the server processes the request without validating the user's role.

The attack flow:

1. Attacker authenticates as a low-privileged user (e.g., operator or viewer).
2. Attacker crafts an HTTP DELETE request targeting the user group deletion endpoint.
3. The server executes the deletion without checking if the user has admin rights.
4. User groups are removed, potentially locking out legitimate users or disrupting group-based access controls.

The root cause is the absence of a role-based access control (RBAC) check in the Lua route handler. The code likely relies on the client to enforce permissions, which is insecure.

Vulnerable vs. Patched Code

Vulnerable Code (maxprofile/user-groups/routes.lua):

-- No authorization check
local function delete_user_group(group_id)
    -- Directly delete from database
    db:execute("DELETE FROM user_groups WHERE id = ?", group_id)
    return { status = "success" }
end

Patched Code (Hypothetical):

-- Authorization check added
local function delete_user_group(user, group_id)
    if not user.is_admin then
        return { status = "error", message = "Unauthorized" }
    end
    db:execute("DELETE FROM user_groups WHERE id = ?", group_id)
    return { status = "success" }
end

The patch adds a check for administrative privileges before executing the deletion. Without the patch, any authenticated user can delete groups.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Q-Free MaxTime instance (version <= 2.11.0).
• Valid low-privileged credentials (e.g., username: operator, password: password123).

Exploitation Steps:

1. Authenticate and obtain a session cookie.
2. Identify the user group deletion endpoint (e.g., /maxprofile/user-groups/delete).
3. Send a DELETE request with the target group ID.

Example using cURL:

curl -X DELETE \
  -H "Cookie: session=valid_session_cookie" \
  -H "Content-Type: application/json" \
  -d '{"group_id": 5}' \
  http://target/maxprofile/user-groups/delete

Expected Outcome: The user group with ID 5 is removed from the system.

Blue Team

Detection:

• Monitor for DELETE requests to /maxprofile/user-groups/delete from non-admin users.
• Alert on rapid deletion of multiple user groups.
• Correlate with authentication logs to identify low-privileged accounts performing admin actions.

Hunting:

• Search for HTTP DELETE methods in web server logs targeting the user groups endpoint.
• Review database audit logs for unexpected DELETE FROM user_groups queries.

Indicators of Compromise (IOCs)

• Network: HTTP DELETE requests to /maxprofile/user-groups/delete with a JSON body containing group_id.
• Logs: Web server logs showing DELETE /maxprofile/user-groups/delete from IPs associated with low-privileged users.
• Database: Missing user groups in the user_groups table without corresponding admin action.
• System: Error messages indicating missing user groups when attempting to assign roles.

Detection Engineering

YARA Rule

rule CVE_2025_26368_QFree_MaxTime_Delete_Group {
    meta:
        description = "Detects exploitation attempts of CVE-2025-26368 in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26368"
    strings:
        $s1 = "DELETE FROM user_groups" ascii wide nocase
        $s2 = "/maxprofile/user-groups/delete" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-26368 - Q-Free MaxTime User Group Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized deletion of user groups via HTTP DELETE requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'DELETE'
        cs-uri-stem: '/maxprofile/user-groups/delete'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26368 Q-Free MaxTime User Group Deletion"; flow:to_server; http.method; content:"DELETE"; http.uri; content:"/maxprofile/user-groups/delete"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from untrusted networks.
2. Restrict access to the MaxTime web interface to trusted IPs only.
3. Monitor logs for suspicious DELETE requests to user group endpoints.

Long-term Fix:

• Apply vendor patch when available.
• Implement proper RBAC checks in all sensitive endpoints.
• Conduct a code review of all Lua route handlers for missing authorization.

Workaround:

• Modify the maxprofile/user-groups/routes.lua file to add authorization checks (see patched code example).
• Deploy a WAF rule to block DELETE requests to /maxprofile/user-groups/delete from non-admin users.

Valters IT – Your trusted partner in DevSecOps and Cyber Threat Intelligence.