MongoBleed (CVE-2025-14847): A Critical MongoDB Memory Leak Vulnerability Hidden for 8 Years
Overview In late 2025, a high-severity memory information disclosure vulnerability that had been lurking in MongoDB for years was finally revealed. Dubbed MongoBleed, this flaw allows unauthenticated attackers to read uninitialized heap memory, potentially exposing sensitive information. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to
React2Shell: Serious RCE Vulnerability Threatening the Latest Web Frameworks (CVE-2025-55182)
Overview In December 2025, a serious security vulnerability named Reach2Shell was disclosed, shaking the web development ecosystem. This vulnerability affects applications using React Server Components and the Flight protocol, allowing threat actors to execute arbitrary code on the server with a single HTTP request. It has been given a Common
The Shadow of JWT-Based Authentication: A Fatal Threat Behind the Convenience
Overview JWT, which has become the standard for modern web applications and mobile apps, provides the convenience of stateless authentication. However, when operated and managed unsafely, it can become a single point of failure that collapses the entire authentication system. This post introduces the concept and authentication methods of JWT,
Distribution of EtherRAT Malware Exploiting React2Shell Vulnerability (CVE-2025-55182)
AhnLab SEcurity intelligence Center (ASEC) recently discovered an advanced malware distribution campaign using Node.js while tracking the recently disclosed React2Shell vulnerability. This attack installs EtherRAT through multiple stages, with the ultimate goal of gaining a foothold, stealing information, and stealing cryptocurrency. After the threat actor accessed the IP address
Bypassing Mark of the Web (MoTW) via Windows Shortcuts (LNK): LNK Stomping Technique
Overview While Windows shortcut (LNK) files are designed for user convenience, they have long been exploited as initial access vectors by threat actors. Since Microsoft strengthened its macro-blocking policies in 2022, attackers have increasingly turned to alternative formats such as ISO, RAR, and LNK files in their attacks. LNK files
Zip Slip, Path Traversal Vulnerability during File Decompression
Overview Path traversal or directory traversal vulnerabilities are security vulnerabilities that occur mainly due to improper validation of user inputs. Attackers can read, modify, or even create new files that are originally inaccessible or located in unintended paths using relative or absolute paths. Although these vulnerabilities have been known for
Mark of the Web (MoTW) Bypass Vulnerability
Overview Mark of the Web (MoTW) is a Windows feature that identifies files downloaded from the Internet and displays a security warning, as well as restricts the files to be executed with a warning message or in a protected mode. However, threat actors have been bypassing Mark of the Web
Legacy Driver Exploitation Through Bypassing Certificate Verification
1. Overview In June 2024, the security company CheckPoint-Research (CPR) published a post on a security threat that used the Legacy Driver Exploitation technique. This attack mostly focused on remotely controlling infected systems using the Gh0stRAT malware and causing additional damage. The threat actor distributed malware using a phishing site
Status of Korean Servers Exposed to Ivanti Connect Secure Vulnerabilities (Multiple CVEs)
Multiple vulnerabilities have been disclosed for the Ivanti Connect Secure product, including several with a CVSS score of 9 or higher (CRITICAL). The majority of Ivanti Connect Secure servers operating in Korea have been identified as vulnerable versions. Figure 1. Default connection screen of Ivanti Connect Secure Ivanti
Status of Korean Servers Exposed to Grafana Vulnerability (CVE-2024-9264)
A critical security vulnerability in Grafana was announced and many Korean servers have been identified as using the vulnerable versions. Grafana is widely known as an open-source platform for visualizing and monitoring data. Figure 1. Grafana login screen The CVE-2024-9264 vulnerability disclosed on October 18th, 2024 is a
