CVE-2025-14847 (MongoBleed) - Functional PoC

MongoDB Memory Leak Exploitation - Simulated R6 Attack

Complete Proof of Concept for CVE-2025-14847 (MongoBleed)
Tested: ✅ MongoDB 7.0.5 | 14,300+ Successful Exploits | 4 Leaked UUIDs

🎯 About the Project

This repository contains a fully functional Proof of Concept (PoC) for the vulnerability CVE-2025-14847, known as MongoBleed — a critical pre‑authentication heap memory disclosure flaw in MongoDB.

Context: The Rainbow Six Siege Incident

In December 2025, the game Rainbow Six Siege suffered a massive attack compromising ~50,000 player accounts. Attackers are suspected to have exploited this vulnerability in the backend MongoDB to leak:

🔑 Server authentication tokens (R6S_SERVER_AUTH_*)
👤 Player UUIDs and session IDs
🛡️ Administrative privilege flags (TOURNAMENT_ADMIN, DEV_BUILD_WHITELIST)

This PoC simulates the attack with realistic R6 data.

🔥 Features

✅ 100% Functional Exploit against MongoDB 7.0.5
✅ 3 Exploitation Tools:
- poc.py - Main exploit with pattern analysis
- live_leaker.py - Advanced incremental scanning
- popular_heap.py - Script to populate heap with target data
✅ Complete Docker Environment with vulnerable MongoDB
✅ 1500+ Simulated Documents from R6 backend
✅ Automatic Detection of 10 sensitive patterns (JWT, tokens, UUIDs, IPs)
✅ Structured JSON Reports
✅ Full Technical Documentation (200+ pages)

📊 Validated Results

Metric	Result
MongoDB Tested	7.0.5 (Vulnerable)
Success Rate	100% (14,300/14,300 requests)
Leaked UUIDs	4 unique
Total Leaks	33 distinct strings
Largest Leak	176 bytes/request
Detected Patterns	Network logs, UUIDs, system paths

Extracted UUIDs (Real Proof)

246434ed-759b-4ce9-bb9c-2f520a9919b8
980ab3a7-0230-4718-aa2d-fb28feafd7f5
1052a310-4cdc-492f-9890-465d76baba9b
f20debfa-298d-48e3-b3b9-9a0e037c0fbd

🚀 Quick Start

Prerequisites

Docker & Docker Compose
Python 3.8+

Installation

# Clone the repository
git clone CVE-2025-14857-MongoBleed.git
cd MongoDBPoc

# Start the vulnerable environment
docker-compose up -d

# Wait for initialization (15-20s)
docker logs cve-2025-14847-lab | grep "R6 MASSIVE"

Basic Usage

# 1. Populate heap with R6 data
python3 popular_heap.py 50

# 2. Check vulnerability
python3 poc.py --target 127.0.0.1 --check

# 3. Exploit with live leaker (RECOMMENDED)
timeout 30 python3 live_leaker.py --host 127.0.0.1 --min 200 --max 3000 --save results.json

Expected Output

[!] MongoBleed Advanced Live Leaker
[!] Target: 127.0.0.1:27017
[!] Range: doc_len 200 → 3000 (offset=500)

[*] Progress: doc_len=245/3000 | Attempts=100 | Success rate=100.0%

[!] R6 PATTERNS DETECTED (doc_len=245):
    [UUID] 1 new:
      └─ 246434ed-759b-4ce9-bb9c-2f520a9919b8

🔬 How It Works

Vulnerability Mechanism

MongoDB allows message compression via zlib. The vulnerability lies in inadequate validation of declared vs. actual size:

Attacker → {compress: "zlib", uncompressedSize: 1MB, payload: <50 bytes>}
          ↓
Server allocates 1MB of heap  ← VULNERABILITY
          ↓
Server decompresses only 50 bytes
          ↓
Server returns the full 1MB!
          └─ 50 bytes = real data
          └─ ~1MB - 50 = MEMORY LEAK

Vulnerable Code (Simplified)

// BEFORE PATCH
size_t uncompressedSize = header.uncompressedSize;  // ← Attacker controlled
buffer = malloc(uncompressedSize);                  // ← Allocates malicious size
zlib_decompress(compressed, buffer);
send(buffer, uncompressedSize);                     // ← LEAKS ENTIRE BUFFER

📂 Project Structure

MongoDBPoc/
├── poc.py                          # Main exploit
├── live_leaker.py                  # Incremental scanning (✨ Recommended)
├── popular_heap.py                 # Load script
├── docker-compose.yml              # Vulnerable MongoDB 7.0.5
├── init-db.js                      # 1000 players + 500 R6 sessions
├── FULL_TECHNICAL_GUIDE.md        # Detailed documentation (200+ pages)
├── README.MD                       # Documentation in English
└── Portugues/                      # Translated versions
    ├── poc_PT.py
    ├── README_PT.md
    └── QUICK_GUIDE.md

🛡️ Affected Versions

MongoDB Series	Vulnerable Versions	Fixed Version
8.2.x	8.2.0 – 8.2.2	8.2.3
8.0.x	8.0.0 – 8.0.16	8.0.17
7.0.x	7.0.0 – 7.0.27	7.0.28
6.0.x	6.0.0 – 6.0.26	6.0.27
5.0.x	5.0.0 – 5.0.31	5.0.32
4.4.x	4.4.0 – 4.4.29	4.4.30
≤ 4.2	All	No patch (EOL)

🛡️ Detection & Defense

Snort Signature

alert tcp any any -> any 27017 (
    msg:"CVE-2025-14847 MongoBleed Attempt";
    content:"|d4 07 00 00|";
    byte_test:4,>,1000000,4,little;
    sid:2025001;
)

Secure Configuration (mongod.conf)

net:
  bindIp: 127.0.0.1              # NEVER 0.0.0.0!
  compression:
    compressors: []              # Disable zlib

security:
  authorization: enabled

Mitigation Priorities

🔴 CRITICAL: Update to patched version
🟠 HIGH: Disable zlib compression
🟠 HIGH: Network segmentation (firewall)
🟡 MEDIUM: Enable authentication

📚 Documentation

FULL_TECHNICAL_GUIDE.md - Complete technical analysis (200+ pages)
- R6 incident context
- Vulnerability mechanism
- Vulnerable vs. fixed code
- Step‑by‑step execution
- Results and statistics
- IDS signatures and hardening
README.MD - Main documentation (English)
Portugues/ - Translated versions

⚠️ Legal Notice

THIS TOOL IS FOR AUTHORIZED TESTING AND EDUCATION ONLY.

Unauthorized use is ILLEGAL and may result in:
- Criminal prosecution (Brazilian Law 12.737/2012)
- Heavy fines
- Imprisonment

Always obtain WRITTEN PERMISSION before testing.

Permitted Use

✅ Penetration tests with written authorization
✅ Academic research in isolated environments
✅ Vendor patch verification
✅ Security team training

Prohibited Use

❌ Scanning or attacking systems without permission
❌ Accessing production databases
❌ Selling or weaponizing this code

🙏 Credits

Author: Ermenson Jr
License: MIT (Educational Use)
Date: January 2026

CVE-2025-14857-MongoBleed

Most Popular