CVE-2025-26370

Executive Summary

CVE-2025-26370 is a critical Missing Authorization vulnerability (CWE-862) discovered in Q-Free MaxTime, a traffic management and parking enforcement platform. The flaw resides in the maxprofile/user-groups/routes.lua file, allowing an authenticated attacker with low-privileged access to remove privileges from user groups via crafted HTTP requests. This effectively enables privilege escalation by stripping security controls from higher-privileged groups, potentially leading to unauthorized administrative actions. The vulnerability affects all versions up to and including 2.11.0. No patch has been publicly released, and no exploit code or proof-of-concept is currently available in public repositories. The EPSS score of 0.0% suggests low exploitation activity in the wild, but the risk remains significant for organizations using this software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker must have a valid low-privileged account.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited information disclosure may occur.
• Integrity Impact: High (I:H) – The attacker can modify user group privileges, potentially granting themselves full administrative rights.
• Availability Impact: Low (A:L) – The attack may cause minor service disruption.

Threat Level: High. The combination of low privileges required, network accessibility, and high integrity impact makes this a serious threat for any organization using Q-Free MaxTime.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The file maxprofile/user-groups/routes.lua handles HTTP requests related to user group management. The flaw is that the application fails to verify whether the authenticated user has the necessary permissions to modify user group privileges. Specifically, the endpoint responsible for removing privileges from user groups does not check if the requesting user is an administrator or has the appropriate role.

Attack Flow:

1. An attacker obtains a low-privileged account (e.g., a standard operator or viewer) on the Q-Free MaxTime system.
2. The attacker crafts an HTTP request to the vulnerable endpoint, targeting a user group with higher privileges (e.g., "admin" or "supervisor").
3. The request includes parameters to remove specific privileges from that group.
4. The server processes the request without authorization checks, stripping the targeted group of its privileges.
5. The attacker can then exploit the now-weakened group to perform actions that were previously restricted, potentially leading to full system compromise.

Root Cause: The routes.lua file likely uses a function to handle privilege removal but does not invoke an authorization middleware or check the user's session for administrative rights. This is a common oversight in Lua-based web applications where developers assume that only the frontend will enforce access controls.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (maxprofile/user-groups/routes.lua):

-- Vulnerable: No authorization check
local function remove_privilege(group_id, privilege_id)
    -- Directly removes privilege without checking user role
    db.execute("DELETE FROM group_privileges WHERE group_id = ? AND privilege_id = ?", group_id, privilege_id)
end

-- Route handler
app:post("/user-groups/remove-privilege", function(req, res)
    local group_id = req.body.group_id
    local privilege_id = req.body.privilege_id
    remove_privilege(group_id, privilege_id)
    res:send({ status = "success" })
end)

Patched Code (Hypothetical):

-- Patched: Added authorization check
local function is_admin(user_id)
    local role = db.query("SELECT role FROM users WHERE id = ?", user_id)
    return role == "admin"
end

local function remove_privilege(group_id, privilege_id)
    db.execute("DELETE FROM group_privileges WHERE group_id = ? AND privilege_id = ?", group_id, privilege_id)
end

app:post("/user-groups/remove-privilege", function(req, res)
    if not is_admin(req.session.user_id) then
        res:status(403):send({ error = "Forbidden" })
        return
    end
    local group_id = req.body.group_id
    local privilege_id = req.body.privilege_id
    remove_privilege(group_id, privilege_id)
    res:send({ status = "success" })
end)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid low-privileged account on Q-Free MaxTime (e.g., username: operator, password: password123).
• Network access to the MaxTime web interface (typically on port 80 or 443).
• Knowledge of the target user group IDs (e.g., group ID 1 for "admin").

Exploitation Steps:

1. Authenticate and obtain a session cookie.
2. Identify the vulnerable endpoint: POST /user-groups/remove-privilege.
3. Craft a request to remove a critical privilege from the admin group:

   POST /user-groups/remove-privilege HTTP/1.1
   Host: target-maxime.local
   Cookie: session=valid_session_cookie
   Content-Type: application/json
   
   {
     "group_id": 1,
     "privilege_id": 5
   }
   

4. Repeat for other privileges to fully disable the admin group.
5. Escalate privileges by exploiting the now-weakened group.

Note: No public exploit code exists. The above is a conceptual example.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual HTTP POST requests to /user-groups/remove-privilege from non-admin users.
• Alert on multiple privilege removal attempts within a short time window.
• Correlate with failed login attempts or privilege escalation events.

Defense:

• Immediately restrict access to the vulnerable endpoint to only admin IPs or VPN.
• Implement a Web Application Firewall (WAF) rule to block requests to /user-groups/remove-privilege from non-admin users.
• Enable detailed logging for all user group modifications.
• Conduct a code review of routes.lua and add authorization checks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /user-groups/remove-privilege with JSON payloads containing group_id and privilege_id.
  • Repeated 403 errors followed by successful privilege removal (indicating bypass).
• System IOCs:
  • Unexpected changes in user group privileges in the MaxTime database.
  • Log entries showing privilege removal by non-admin users.
• File IOCs:
  • Modified maxprofile/user-groups/routes.lua file (if attacker patches it).
  • Suspicious Lua scripts in the web root.

Detection Engineering

YARA Rule

rule CVE_2025_26370_QFree_MaxTime_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-26370 in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26370"
    strings:
        $s1 = "/user-groups/remove-privilege" ascii wide nocase
        $s2 = "group_id" ascii wide nocase
        $s3 = "privilege_id" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-26370 - Q-Free MaxTime Missing Authorization Exploitation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to the vulnerable endpoint from non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/user-groups/remove-privilege'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26370 - Q-Free MaxTime Missing Authorization Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/user-groups/remove-privilege"; http_uri; content:"group_id"; http_client_body; content:"privilege_id"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by blocking access to /user-groups/remove-privilege in the web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Restrict access to the MaxTime admin interface to trusted IP addresses only.
3. Review user accounts and remove any suspicious low-privileged accounts.

Long-term Fix:

• Apply a vendor patch once released. Since no patch is available, consider implementing a custom fix:
  • Modify maxprofile/user-groups/routes.lua to add authorization checks (see patched code example).
  • Rebuild and redeploy the application.
• Conduct a full security audit of the MaxTime codebase for similar authorization flaws.

Workaround:

• Implement a WAF rule to block POST requests to /user-groups/remove-privilege unless the user is an admin (e.g., by checking a custom header or session token).

Valters IT