CVE-2025-26372

Executive Summary

CVE-2025-26372 is a Missing Authorization vulnerability (CWE-862) in Q-Free MaxTime, a traffic management and tolling system. The flaw resides in the maxprofile/user-groups/routes.lua file, allowing an authenticated attacker with low privileges to remove users from groups via crafted HTTP requests. This can lead to unauthorized privilege escalation, service disruption, or data integrity issues. The CVSS score is 7.1 (High), and no patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for affected deployments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H)
• Availability Impact: Low (A:L)

The threat level is High due to the low attack complexity and the potential for integrity impact. An attacker can remove users from groups, potentially disrupting access control and enabling further attacks.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization checks. The maxprofile/user-groups/routes.lua file handles HTTP requests for modifying user-group associations. The code likely lacks proper validation to ensure that the requesting user has the necessary permissions (e.g., admin or group manager) to remove users from groups. An authenticated low-privileged attacker can send a crafted HTTP request (e.g., POST or DELETE) to the vulnerable endpoint, bypassing authorization checks.

The attack flow:

1. Attacker authenticates with low-privileged credentials.
2. Attacker crafts an HTTP request targeting the user-group removal endpoint.
3. The server processes the request without verifying the attacker's authorization.
4. The target user is removed from the group, potentially losing access to resources or privileges.

This can be exploited to:

• Remove administrators from critical groups.
• Disrupt user access to tolling or traffic management systems.
• Escalate privileges by removing users from restrictive groups.

Vulnerable vs. Patched Code

Vulnerable Code (Q-Free MaxTime <= 2.11.0):

-- maxprofile/user-groups/routes.lua
local function removeUserFromGroup(userId, groupId)
    -- Missing authorization check
    db.query("DELETE FROM user_groups WHERE user_id = ? AND group_id = ?", userId, groupId)
end

Patched Code (Hypothetical):

-- maxprofile/user-groups/routes.lua
local function removeUserFromGroup(userId, groupId, requestingUserId)
    -- Authorization check
    if not isAdmin(requestingUserId) and not isGroupManager(requestingUserId, groupId) then
        return error("Unauthorized")
    end
    db.query("DELETE FROM user_groups WHERE user_id = ? AND group_id = ?", userId, groupId)
end

The patched version adds an authorization check to ensure the requesting user has admin or group manager privileges.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Q-Free MaxTime instance (version <= 2.11.0).
• Low-privileged credentials (e.g., username: attacker, password: password123).

Exploitation Steps:

1. Authenticate and obtain a session token.
2. Identify the target user ID and group ID (e.g., via enumeration or known values).
3. Send a crafted HTTP request to remove the user from the group.

Example HTTP Request:

POST /maxprofile/user-groups/remove HTTP/1.1
Host: target.com
Cookie: session=attacker_session_token
Content-Type: application/json

{
  "user_id": 1,
  "group_id": 2
}

Expected Outcome: The user with ID 1 is removed from group ID 2, potentially losing access to resources.

Blue Team

Detection:

• Monitor HTTP requests to /maxprofile/user-groups/remove or similar endpoints.
• Alert on unauthorized user-group modification attempts.
• Review logs for unusual patterns (e.g., low-privileged users making group changes).

Mitigation:

• Implement proper authorization checks (see patched code).
• Restrict access to the vulnerable endpoint via network segmentation or WAF rules.
• Apply the vendor patch when available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /maxprofile/user-groups/remove with low-privileged session tokens.
  • Unusual POST/DELETE requests to user-group management endpoints.
• System IOCs:
  • Log entries showing unauthorized user-group removal attempts.
  • Changes in user-group associations without corresponding admin actions.
• File IOCs:
  • Modified maxprofile/user-groups/routes.lua file (if attacker gains file access).

Detection Engineering

YARA Rule

rule CVE_2025_26372_Missing_Auth {
    meta:
        description = "Detects vulnerable Q-Free MaxTime routes.lua file with missing authorization"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-26372"
    strings:
        $s1 = "DELETE FROM user_groups" nocase
        $s2 = "removeUserFromGroup" nocase
        $s3 = "routes.lua" nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2025-26372 - Missing Authorization in Q-Free MaxTime
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized user-group removal attempts in Q-Free MaxTime
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/maxprofile/user-groups/remove'
        cs-username: 'attacker'  # Replace with actual low-privileged user
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26372 - Q-Free MaxTime Missing Authorization"; flow:to_server; content:"POST"; http_method; content:"/maxprofile/user-groups/remove"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Limit access to the MaxTime web interface to trusted IPs only.
2. Implement WAF Rules: Block requests to /maxprofile/user-groups/remove from non-admin users.
3. Monitor Logs: Enable detailed logging and alert on unauthorized group modification attempts.

Long-Term Fix:

• Apply vendor patch when available (currently UNKNOWN).
• Implement proper authorization checks in routes.lua as shown in the patched code example.
• Conduct a security audit of all endpoints for similar missing authorization issues.

Workaround:

• Disable the user-group management feature if not required, or restrict it to admin-only access via configuration.

Valters IT