id: CVE-2025-14847

info:
  name: MongoDB Server - Information Disclosure (MongoBleed)
  author: pussycat0x,joe-desimone,DhiyaneshDK,Wiz Research,diedromeo
  severity: high
  description: |
    MongoDB Server contained a flaw in the zlib decompression logic where mismatched length fields in compressed protocol headers allowed a read of uninitialized heap memory by an unauthenticated client.
  impact: |
    Unauthenticated clients can read uninitialized heap memory, potentially exposing credentials, session tokens, API keys, and other sensitive data.
  remediation: |
    Update to versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. Alternatively, disable zlib compression using snappy,zstd or disabled.
  reference:
    - https://jira.mongodb.org/browse/SERVER-115508
    - https://github.com/joe-desimone/mongobleed
    - https://www.wiz.io/blog/mongobleed-cve-2025-14847-exploited-in-the-wild-mongodb
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-14847
    epss-score: 0.83218
    epss-percentile: 0.99677
    cwe-id: CWE-908
  metadata:
    verified: true
    max-request: 1
    vendor: mongodb
    product: mongodb
    shodan-query: product:"MongoDB"
    fofa-query: protocol="mongodb"
  tags: cve,cve2025,mongodb,memory-leak,network,mongobleed,kev,vkev,vuln

tcp:
  - inputs:
      - data: 3b0000003c300000ffffffffd40700000000000061646d696e2e24636d640000000000ffffffff14000000106275696c64696e666f000100000000
        type: hex
    host:
      - "{{Hostname}}"
    port: 27017
    read-size: 2048

    matchers-condition: and
    matchers:
      - type: word
        part: raw
        words:
          - "version"
          - "gitVersion"
        condition: and

      - type: dsl
        dsl:
          - "compare_versions(version, '>= 8.2.0') && compare_versions(version, '<= 8.2.2')"
          - "compare_versions(version, '>= 8.0.0') && compare_versions(version, '<= 8.0.16')"
          - "compare_versions(version, '>= 7.0.0') && compare_versions(version, '<= 7.0.27')"
          - "compare_versions(version, '>= 6.0.0') && compare_versions(version, '<= 6.0.26')"
          - "compare_versions(version, '>= 5.0.0') && compare_versions(version, '<= 5.0.31')"
          - "compare_versions(version, '>= 4.4.0') && compare_versions(version, '<= 4.4.29')"
          - "compare_versions(version, '>= 4.2.0') && compare_versions(version, '<= 4.2.25')"
          - "compare_versions(version, '>= 4.0.0') && compare_versions(version, '<= 4.0.28')"
          - "compare_versions(version, '>= 3.6.0') && compare_versions(version, '<= 3.6.23')"
        condition: or

    extractors:
      - type: regex
        name: version
        part: raw
        group: 1
        regex:
          - '(?s)version.{0,50}?([0-9]+\.[0-9]+\.[0-9]+)'
# digest: 4a0a0047304502206354081a88640b5a60a1e3a877bb2c063c342eb61fe099fa891d204cffa2ec6c022100d0b6607e6acbfcb97880e1428a9e9ad73717f9405e772520e3710c02247d97c7:922c64590222798bb761d5b6d8e72950