CVE-2025-26373

Executive Summary

CVE-2025-26373 is a Missing Authorization vulnerability (CWE-862) in the Q-Free MaxTime traffic management system, affecting versions up to and including 2.11.0. The flaw resides in the maxprofile/users/routes.lua user endpoint, allowing an authenticated low-privileged attacker to enumerate all system users via crafted HTTP requests. This information disclosure can facilitate targeted attacks, such as credential stuffing or social engineering, against higher-privileged accounts. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). Q-Free MaxTime is a proprietary traffic management system.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (user enumeration)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the direct impact is limited to information disclosure, user enumeration is a critical precursor to more severe attacks like brute-force or phishing campaigns targeting privileged accounts.

Deep Dive & Mechanics

The vulnerability exists in the maxprofile/users/routes.lua file, which handles user-related API endpoints. The endpoint responsible for listing or querying users lacks proper authorization checks. An authenticated attacker with low privileges (e.g., a standard operator account) can send a crafted HTTP request to this endpoint and receive a list of all registered users, including usernames, roles, and potentially other metadata.

Root Cause: The application fails to verify that the requesting user has the necessary permissions (e.g., admin role) to access the user enumeration functionality. The endpoint likely performs authentication (verifying the user is logged in) but not authorization (verifying the user has the right to view all users).

Attack Flow:

1. Attacker obtains low-privileged credentials (e.g., via phishing, default credentials, or previous breach).
2. Attacker logs into the MaxTime web interface.
3. Attacker sends a crafted HTTP GET request to the vulnerable endpoint (e.g., /maxprofile/users/list or similar).
4. The server returns a JSON/XML response containing all user accounts.
5. Attacker uses this information to target high-privileged accounts (e.g., admin) with further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (maxprofile/users/routes.lua - <= 2.11.0):

-- Vulnerable: No authorization check
app.get("/users/list", function(req, res)
    local users = database.query("SELECT username, role FROM users")
    res:json(users)
end)

Patched Code (Hypothetical):

-- Patched: Authorization check added
app.get("/users/list", function(req, res)
    if not req.user or req.user.role ~= "admin" then
        res:status(403):json({ error = "Forbidden" })
        return
    end
    local users = database.query("SELECT username, role FROM users")
    res:json(users)
end)

The patch adds a role check to ensure only users with the admin role can access the endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Q-Free MaxTime instance (version <= 2.11.0)
• Valid low-privileged credentials (e.g., username: operator, password: operator123)

Exploitation Steps:

1. Authenticate to the MaxTime web interface and obtain a session cookie.
2. Send a crafted HTTP request to enumerate users:

   curl -X GET "http://target/maxprofile/users/list" \
        -H "Cookie: session=YOUR_SESSION_COOKIE"
   

3. Parse the response to extract usernames and roles.

Example Response:

[
    {"username": "admin", "role": "admin"},
    {"username": "operator1", "role": "operator"},
    {"username": "engineer", "role": "engineer"}
]

Blue Team

Detection:

• Monitor for unusual access to /maxprofile/users/list or similar endpoints from low-privileged accounts.
• Alert on multiple failed login attempts followed by successful enumeration requests.

Hunting:

• Search logs for HTTP 200 responses to /maxprofile/users/list from non-admin users.
• Correlate with authentication logs to identify the source IP and user account.

Lab Setup:

• Deploy a Q-Free MaxTime instance in an isolated environment.
• Create test accounts with varying privilege levels.
• Use a web proxy (e.g., Burp Suite) to intercept and modify requests.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /maxprofile/users/list or similar endpoints.
  • Unusual volume of requests to user-related API endpoints from a single IP.
• Logs:
  • Access logs showing 200 responses to /maxprofile/users/list from non-admin users.
  • Authentication logs showing low-privileged accounts accessing admin-only endpoints.
• System:
  • Unexpected user enumeration activity in MaxTime audit logs.

Detection Engineering

YARA Rule

rule CVE_2025_26373_User_Enumeration {
    meta:
        description = "Detects exploitation attempts for CVE-2025-26373 in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-26373"
    strings:
        $s1 = "/maxprofile/users/list" ascii wide nocase
        $s2 = "users" ascii wide nocase
        $s3 = "role" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: Q-Free MaxTime User Enumeration via CVE-2025-26373
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the vulnerable user enumeration endpoint in Q-Free MaxTime
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/maxprofile/users/list'
    condition: selection
falsepositives:
    - Legitimate admin access
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-26373 - Q-Free MaxTime User Enumeration Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/maxprofile/users/list"; http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2025-26373;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from untrusted networks if possible.
2. Monitor logs for signs of exploitation (see IOCs).
3. Restrict access to the MaxTime web interface via firewall rules (allow only trusted IPs).

Long-term Fix:

• Apply vendor patch when available.
• Implement proper authorization checks on all user-related endpoints.
• Conduct a security audit of the entire maxprofile module.

Compensating Controls:

• Enable multi-factor authentication (MFA) for all MaxTime accounts.
• Implement Web Application Firewall (WAF) rules to block access to /maxprofile/users/list from non-admin IPs.
• Regularly review user accounts and privileges.

Valters IT
Securing Digital Infrastructure