mongobleed-scanner - MongoDB CVE-2025-14847 Heap Memory Leak Scanner |

项目说明

MongoBleed (C)

MongoBleed is a high-performance PoC scanner for C, a pre-authentication heap memory disclosure in the MongoDB C++ Driver.
The tool is designed for rapid identification of instances across large network ranges.

Technical Analysis

The stems from an out-of-bounds (OOB) read in the MongoDB wire protocol’s handling of OP_COMPRESSED messages.

When a ser an OP_COMPRESSED packet, it relies on the attacker-supplied uncompressedSize field to allocate a buffer for decompression. If the actual decompressed data is significantly smaller than the claimed uncompressedSize, the dri to truncate or clear the buffer. As a result, the ser the entire allocated memory block, which may contain uninitialized heap data, potentially exposing sensiti such as session tokens, internal pointers, or fragments of other database queries.

Features

* Asynchronous I/O using Python asyncio for high-concurrency scanning
* Precise detection by response length against the requested leak size
* Minimal false positi protocol-le
* Automatic logging of targets to .txt

Installation

No external dependencies required (Python Standard Library only).

Usage

Basic usage:

Ad configuration:

Options

* -i : Input file containing targets (IP, domain, or IP:port)
* -c : Concurrency level (default: 50)
* -t : Connection timeout in seconds (default: 5)

Detection Logic

The scanner identifies by exploiting a size mismatch during the BSON decompression phase:

1. The scanner sends a crafted OP_COMPRESSED packet containing a small zlib-compressed payload for example 16-30 bytes .
2. The uncompressedSize field in the packet header is intentionally set to a much larger value (e.g., 64KB).
3. A state is confirmed if the MongoDB ser with a MessageLength that aligns with the requested large buffer size rather than the actual decompressed payload size.
4. The ser uses the attacker-provided uncompressedSize to define the response length. Since it fails to update this length with the actual bytes written during decompression, it blindly streams the entire allocated heap buffer—including uninitialized memory—back to the client.
5. The scanner the response by reading the extra bytes from the stream, which represent uninitialized fragments of the server's heap memory.

Proof of Concept

> Note: The video abo the scanner identifying multiple instances and capturing heap fragments in real-time.

Author

Black1hp
Security Researcher | Bug Hunter | Red Teamer

* GitHub:
* X (Twitter):
* Medium:
* LinkedIn:

Disclaimer

This tool is intended for authorized security testing and research purposes only.
The author is not responsible for any unauthorized use or damage resulting from this tool.

项目信息

开发语言：Python

Star 数：35

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕MongoDB CVE-2025-14847 Heap Memory Leak Scanner | OP_COMPRESSED zlib Vulnerability | Bug Bounty & Red Team Tool展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。