CVE-2025-60357 Overview
CVE-2025-60357 is a NoSQL injection vulnerability in AhnLab EPP Management version 1.0.14.32-6249. The flaw resides in the eventlog/agentEvent/list endpoint, which fails to properly sanitize user-supplied query operators before passing them to the backend datastore. Authenticated attackers with low privileges can manipulate query logic over the network to extract sensitive event log data or tamper with stored records. The weakness is categorized as [CWE-943] Improper Neutralization of Special Elements in Data Query Logic. A public proof-of-concept exists in the GitHub PoC Repository, increasing exposure risk for organizations running the affected build.
Critical Impact
Authenticated attackers can inject NoSQL operators through the eventlog/agentEvent/list endpoint to read or modify endpoint protection event data.
Affected Products
- AhnLab EPP Management v1.0.14.32-6249
- Endpoint Protection Platform management console
- The eventlog/agentEvent/list API endpoint
Discovery Timeline
- 2026-07-17 - CVE-2025-60357 published to the National Vulnerability Database
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2025-60357
Vulnerability Analysis
The vulnerability affects the AhnLab EPP Management console, a centralized administration tool for AhnLab endpoint protection agents. The eventlog/agentEvent/list endpoint accepts client-supplied parameters that are incorporated into NoSQL queries without adequate validation. Attackers can supply query operators, such as comparison or logical operators, to alter the intended query semantics. Successful injection results in high impact to confidentiality and integrity because event log data can be enumerated, filtered arbitrarily, or manipulated. The attack requires network access and low privileges but no user interaction. Availability is not affected under the scored conditions.
Root Cause
The root cause is improper neutralization of special elements used in a data query, tracked as [CWE-943]. The application trusts request parameters and interpolates them directly into a NoSQL query document. Operator keys and nested structures submitted by the client are not stripped or type-coerced, allowing the query to be reshaped by the attacker. Because event logs frequently contain sensitive telemetry from managed endpoints, the flaw exposes forensic and operational data to unauthorized access.
Attack Vector
Exploitation targets the eventlog/agentEvent/list endpoint over the network. An attacker with a low-privileged authenticated session sends a crafted request containing NoSQL operators embedded in filter parameters. The server evaluates the manipulated query and returns records outside the caller's authorization boundary, or applies unintended modifications. A public proof-of-concept is available in the GitHub PoC Repository, which demonstrates the injection primitive against the vulnerable endpoint.
Detection Methods for CVE-2025-60357
Indicators of Compromise
- Requests to eventlog/agentEvent/list containing NoSQL operator tokens such as $ne, $gt, $where, $regex, or $or in query parameters or JSON bodies.
- Unusually large or repetitive result sets returned from the event log endpoint to a single authenticated session.
- Authentication events from low-privileged operator accounts followed by anomalous queries against event log APIs.
Detection Strategies
- Inspect HTTP request bodies and query strings destined for the EPP Management console for embedded JSON objects containing MongoDB-style operators.
- Enable verbose application logging on the EPP Management server and correlate parameter values against a deny list of NoSQL operator prefixes.
- Baseline normal query volume and shape per operator account, then alert on statistical deviations against the agentEvent/list route.
Monitoring Recommendations
- Forward EPP Management access logs to a centralized SIEM and build detections for operator characters ($, {, }) in parameter values.
- Monitor administrator and operator account activity for privilege reuse from unexpected source addresses.
- Track outbound data volumes from the EPP Management host to detect bulk exfiltration of event log records.
How to Mitigate CVE-2025-60357
Immediate Actions Required
- Restrict network access to the AhnLab EPP Management console to trusted administrative networks and VPN segments.
- Rotate credentials for all operator and administrator accounts and enforce strong authentication on the console.
- Review recent access to the eventlog/agentEvent/list endpoint and preserve logs for forensic analysis.
Patch Information
No fixed version is listed in the NVD entry for CVE-2025-60357 at the time of publication. Consult AhnLab Security Insights for vendor advisories and updated builds that supersede 1.0.14.32-6249. Apply vendor-supplied updates as soon as they become available and verify the installed version after patching.
Workarounds
- Place a reverse proxy or web application firewall in front of the EPP Management console and block requests containing NoSQL operator syntax in parameters.
- Enforce least privilege on management console accounts and remove unused operator roles until a patch is applied.
- Segment the EPP Management server from general user networks so that only jump hosts can reach the administrative API.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
