NoSQL Injection Vulnerability in AhnLab EPP Management

Executive Summary

CVE-2025-60357 is a NoSQL injection vulnerability in AhnLab EPP Management v1.0.14.32-6249. It allows authenticated attackers to inject malicious MongoDB queries via the eventlog/agentEvent/list endpoint to extract sensitive data like PII.

Useful 0 Not Useful 0

Detection Guidance

To detect this NoSQL injection vulnerability in AhnLab EPP Management, monitor network traffic for suspicious requests to the /api/console/ems/eventlog/agentEvent/list endpoint. Check for unusual MongoDB query patterns in logs, such as appended malicious queries in request bodies. Use tools like Wireshark or tcpdump to inspect HTTP POST requests containing JSON payloads with MongoDB operators like $ne, $gt, or $where.

Useful 0 Not Useful 0

Impact Analysis

Attackers could bypass authentication and access unauthorized logs containing sensitive information such as IP addresses, computer names, login IDs, MAC addresses, and other PII. This could lead to data breaches or unauthorized access to confidential data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personally identifiable information (PII), which may violate GDPR and HIPAA compliance requirements. Organizations using the affected software must ensure proper patching to avoid regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AhnLab EPP Management to version P16.25 or later to patch the vulnerability. If updating is not possible, restrict access to the /api/console/ems/eventlog/agentEvent/list endpoint via network segmentation or firewall rules. Implement strict input validation for all API requests and monitor for unauthorized data access attempts.

Useful 0 Not Useful 0