NoSQL Injection in AhnLab EPP Management Agent Event Logging

CVE-2025-60357 is a high-severity NoSQL injection vulnerability (CVSS 8.1) in AhnLab EPP Management v1.0.14.32-6249, specifically within the eventlog/agentEvent/list endpoint. NoSQL injection attacks allow attackers to manipulate database queries by injecting malicious operators or syntax into user-controlled input, bypassing authentication and authorization checks. This vulnerability affects organizations relying on AhnLab's endpoint protection platform for security event management and logging. An unauthenticated attacker could exploit this flaw to query, extract, or modify sensitive event logs, potentially exposing security incidents, agent status information, or other critical operational data stored in the NoSQL database.

While this CVE has not yet been mapped to specific MITRE ATT&CK techniques, practitioners using Casky.ai would leverage Claude's extended reasoning capabilities to identify attack patterns associated with data access and exfiltration techniques such as T1530 (Data from Cloud Storage) or T1213 (Data from Information Repositories). The platform's 754 security skills would help detect suspicious queries to the eventlog endpoint, unusual NoSQL syntax patterns in network traffic, and anomalous database access attempts that deviate from normal application behavior. Practitioners reviewing Casky findings would see detailed analysis of payload structures, query manipulation indicators, and behavioral anomalies that distinguish NoSQL injection exploitation attempts from legitimate logging operations, enabling rapid threat detection and remediation.