CVE-2025-6713

craft aggregation pipeline to access data without proper authorisation due to improper handling of $mergeCursors in MongoDB >v8.0 <8.0.7, >v7.0 <7.0.19, >v6.0 <6.0.22

installation

not very difficult - just use pip3 to install the requirements: pip install -r requirements

usage

python3 CVE-2025-6713

tinkering

what do to to test it on your own

1. Line 4, 5, 6, 7, 9, 10:

   root@kitploit:~

   mconnect = "mongodb://localhost:27017"
   dbname = ""
   acollection = ""
   rcollection = ""
   
   USERNAME = ""
   PASSWORD = ""
   

   you can:

   • change mconnect to your own mongo uri to connect to your database

   • change dbname to your db name (use, modify or fork the repo to have it test more than 1 db)

   • change acollection to a collection available publicly (accessible)

   • change rcollection to a collection not available publicly (restricted)

   • i think USERNAME & PASSWORD are common sense

2. Line 17 & 18 (in setupTest(db), after [acollection].insert_many([...):

   root@kitploit:~

   {"name": "pubthing1", "data": "pub stuff"},
   {"name": "pubthing2", "data": "pub stuff"}
   

   here, the script is just inserting test data into the db (does NOT have to be anything specific. it can literally be anything)

3. Line 22 & 23 (in setupTest(db), after [rcollection].insert_many([...):

   root@kitploit:~

   {"name": "secret", "stuff": "my national insurance number"},
   {"name": "shhhh", "boo": "location of pringles in my house"}
   

   this can also be literally anything too. have fun with it.

the rest - don't change unless you know what you're doing otherwise you'll just get confused and angry