mongobleed-exploit-CVE-2025-14847 - Exploit lab, docker and code scanner for mongoblee

项目说明

🩸 MongoBleed - C Security Research Lab

<p align="center">
<img src="assets/Mongobleed C Mongobleed Blog Option 1.png" alt="MongoBleed Logo" width="600"/>
</p>

<p align="center">
<strong>C | CVSS 8.7 (High) | Unauthenticated Memory Disclosure</strong>
</p>

<p align="center">
<a href="DOCUMENTATION.md">📖 Full Documentation</a> •
<a href="TECHNICAL_ANALYSIS.md">🔬 Technical Analysis</a> •
<a href="QUICK_COMMANDS.md">⚡ Quick Commands</a>
</p>

---

🎯 C Summary

MongoBleed is a critical memory disclosure in MongoDB's network transport layer that allows unauthenticated remote attackers to exfiltrate sensitive heap memory without any credentials or user interaction.

Impact

| Category | Description |
|----------|-------------|
| Attack Type | Remote, unauthenticated memory disclosure |
| Root Cause | Zlib decompression returns allocated buffer size instead of actual data length |
| Data Exposed | Database passwords, API keys, session tokens, AWS credentials, internal ser |
| Se | CVSS 8.7 (High) - Network-accessible, no auth required |
| Exploitation | Acti observed in the wild since Dec 28, 2025 |

(At a Glance)

| Branch | | Fixed | Action |
|--------|------------|-------|--------|
| 8.2.x | 8.2.0 → 8.2.2 | 8.2.3 | Upgrade immediately |
| 8.0.x | 8.0.0 → 8.0.16 | 8.0.17 | Upgrade immediately |
| 7.0.x | 7.0.0 → 7.0.27 | 7.0.28 | Upgrade immediately |
| 6.0.x | 6.0.0 → 6.0.26 | 6.0.27 | Upgrade immediately |
| 5.0.x | 5.0.0 → 5.0.31 | 5.0.32 | Upgrade immediately |
| 4.4.x | 4.4.0 → 4.4.29 | 4.4.30 | Upgrade immediately |
| ≤4.2.x | All | None | ⚠️ EOL - Migrate to supported |

> 📖 See Full Affected Table →

Exposure Scale

87,000 - 194,000 MongoDB instances publicly exposed

42% of cloud en host instances (Wiz Research)

No authentication required - attack occurs pre-auth

Silent exploitation - no logs, no crashes

---

TL;DR for Engineering Teams

| Aspect | Details |
|--------|---------|
| What is | MongoDB Ser transport layer using zlib compression |
| Se | High (CVSS 8.7/7.5) |
| Impact | Unauthenticated, remote disclosure of uninitialised heap memory |
| Why it matters | Leaked fragments contain database passwords, AWS secret keys, and internal ser |
| Exploit status | Public Proof-of-Concept (PoC) "mongobleed" is and circulating |
| What to do today | Upgrade to patched immediately or disable zlib compression |

🔬 Anatomy

Technical Analysis

The exists in MongoDB's network transport layer (message_compressor_zlib.cpp) where a critical flaw in the zlib decompression logic allows unauthenticated attackers to leak sensiti memory.

#### Root Cause

#### Exploitation Flow

Discovery Timeline

| Date | Event |
|------|-------|
| 15 Dec 2025 | identified; internal ticket SER |
| 19 Dec 2025 | Fix released, C disclosed |
| 24 Dec 2025 | MongoDB Atlas fleet patched |
| 26 Dec 2025 | Public PoC "mongobleed" released |
| 28 Dec 2025 | Exploitation observed in the wild |

> 🔬 See Technical Analysis → for detailed anatomy, exploit construction, and detection methods.

📁 Project Structure

🚀 Quick Start

1. Exploit Lab

2. Network Scanner

3. Code Scanner

⚡ Quick Commands

📊 Output Examples

Exploit Output

Network Scanner Output

Code Scanner Output

🛡️ Remediation Summary

| Priority | Action | Details |
|----------|--------|---------|
| 🔴 1 | Upgrade MongoDB | Update to fixed (8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30) |
| 🟠 2 | Disable zlib | mongod --setParameter networkMessageCompressors=snappy,zstd |
| 🟡 3 | Network isolation | Firewall port 27017, use networking |
| 🔵 4 | Rotate credentials | If exposed, rotate all database passwords, API keys, tokens |

> 📖 See Full Remediation Guide →

---

🔗 Phoenix Security Integration

All scanners support uploading findings to Phoenix Security platform:

---

🔐 Security Notice

⚠️ IMPORTANT: This toolkit is provided for authorized security testing and research purposes only.

Only test systems you own or ha written permission to test

Unauthorized access to computer systems is illegal

Leaked data may contain sensiti - handle responsibly

Report through proper disclosure channels

📚 Documentation

Core Documentation

| Document | Description |
|----------|-------------|
| 📖 DOCUMENTATION.md | Complete project documentation with setup, usage, and remediation |
| 🔬 TECHNICAL_ANALYSIS.md | In-depth anatomy, exploit mechanism, and detection |
| ⚡ QUICK_COMMANDS.md | Copy-paste ready commands for all tools |

Tool Documentation

| Tool | Documentation | Description |
|------|---------------|-------------|
| 🔴 Exploit Lab | exploit/README.md | Docker-based /patched MongoDB lab |
| 🌐 Network Scanner | scanner/README.md | IP/CIDR scanner |
| 📂 Code Scanner | code-scan/README.md | Codebase scanner for |

🔗 External References

OX Security Ad

MongoDB Fix Commit

N - C

👤 Credits

Original exploit by Joe Desimone ()

Lab en and scanner enhancements for security research

📄 License

For authorized security testing only. Use responsibly.

---

Last Updated: December 2025

项目信息

开发语言：Python

Star 数：13

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Exploit lab, docker and code scanner for mongobleed Vulnerability CVE-2025-14847 plus Phoenix Security Sync tools展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。