CVE-2025-26374

Executive Summary

CVE-2025-26374 is a Missing Authorization vulnerability (CWE-862) in Q-Free MaxTime, a traffic management and parking enforcement system. The flaw resides in the maxprofile/users/routes.lua file, specifically within the users endpoint. An authenticated attacker with low-privileged access can exploit this vulnerability to enumerate all registered users on the system by sending crafted HTTP requests. This allows the attacker to gather a list of usernames, which can be used for further targeted attacks such as password spraying or social engineering. The CVSS score is 6.5 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild at the time of analysis. No public proof-of-concept (PoC) or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a valid low-privileged account.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited information disclosure (usernames).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires authentication, but low-privileged access is sufficient. The primary risk is information disclosure, which can facilitate further attacks.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization checks. The maxprofile/users/routes.lua file defines the API endpoints for user management. The users endpoint, likely accessible via a path like /api/users or /maxprofile/users, is intended to be restricted to administrators. However, due to a missing authorization check, any authenticated user (even with the lowest privileges) can access this endpoint.

The attacker can craft an HTTP GET request to the users endpoint. The server, lacking proper validation of the user's role or permissions, will return a list of all registered users. This list typically includes usernames, and potentially other metadata such as email addresses or roles.

The root cause is the absence of a function call to verify the user's authorization level before processing the request. In a secure implementation, the code would check if the authenticated user has the admin role or a similar permission before returning the user list.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual - maxprofile/users/routes.lua):

-- Vulnerable: No authorization check
app.get("/users", function(req, res)
    local users = database.query("SELECT username FROM users")
    res.json(users)
end)

Patched Code (Conceptual):

-- Patched: Authorization check added
app.get("/users", function(req, res)
    if not is_admin(req.user) then
        res.status(403).json({ error = "Forbidden" })
        return
    end
    local users = database.query("SELECT username FROM users")
    res.json(users)
end)

The patched version introduces an is_admin() function that checks the user's role. If the user is not an administrator, the request is denied with a 403 Forbidden status.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid low-privileged user account on a Q-Free MaxTime instance (version <= 2.11.0).
• Network access to the MaxTime web interface.

Exploitation Steps:

1. Authenticate: Obtain a session cookie or API token by logging in with the low-privileged account.
2. Craft Request: Send a GET request to the users endpoint. The exact path may vary, but common paths include:
   • /maxprofile/users
   • /api/users
   • /users/list
3. Enumerate Users: The response will contain a JSON or XML list of usernames.

Example using curl:

curl -X GET "https://target.com/maxprofile/users" \
  -H "Cookie: session=YOUR_SESSION_COOKIE"

Expected Response (JSON):

[
  {"username": "admin"},
  {"username": "operator1"},
  {"username": "enforcer2"},
  {"username": "user123"}
]

Blue Team

Detection:

• Monitor for unusual access to the /maxprofile/users endpoint from non-administrative accounts.
• Look for repeated GET requests to this endpoint from the same IP or user session.
• Alert on any successful response to this endpoint from a user whose role is not admin.

Hunting:

• Search web server logs for requests to /maxprofile/users and correlate with the authenticated user's role.
• Use the Sigma rule provided in the Detection Engineering section to identify potential exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /maxprofile/users, /api/users, or similar paths.
  • Response containing a JSON array of usernames.
• Logs:
  • Web server access logs showing requests to the users endpoint from non-admin users.
  • Application logs showing successful retrieval of user list by a low-privileged user.
• File System:
  • No specific file-based IOCs, as this is a server-side logic flaw.

Detection Engineering

YARA Rule

rule CVE_2025_26374_UserEnumeration {
    meta:
        description = "Detects exploitation attempts for CVE-2025-26374 - Missing Authorization in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26374"
        severity = "medium"
    strings:
        $s1 = "/maxprofile/users" ascii wide nocase
        $s2 = "/api/users" ascii wide nocase
        $s3 = "username" ascii wide nocase
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: Q-Free MaxTime User Enumeration via Missing Authorization
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to enumerate users via the vulnerable /maxprofile/users endpoint in Q-Free MaxTime.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26374
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/maxprofile/users'
            - '/api/users'
    condition: selection
falsepositives:
    - Legitimate administrative access to the user management interface.
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26374 - Q-Free MaxTime User Enumeration Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/maxprofile/users"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: If possible, use a Web Application Firewall (WAF) or reverse proxy to block access to the /maxprofile/users endpoint from non-administrative IP ranges.
2. Monitor Logs: Actively monitor web server logs for unauthorized access attempts to the users endpoint.
3. Disable Low-Privilege Accounts: If not required, disable or remove low-privileged user accounts until a patch is applied.

Long-Term Fix:

1. Apply Patch: Contact Q-Free for an official patch or update to a version higher than 2.11.0 once available.
2. Code Fix: Implement proper authorization checks in maxprofile/users/routes.lua to ensure only users with the admin role can access the users endpoint.
3. Security Review: Conduct a thorough security review of all API endpoints to ensure proper authorization is enforced.

Workaround:

• If patching is not immediately possible, consider modifying the web server configuration to require additional authentication (e.g., client certificates) for the /maxprofile/users path.

Valters IT
Securing Digital Frontiers