alt.hn

12/26/2025 at 6:17:00 PM

MongoBleed

 https://github.com/joe-desimone/mongobleed/blob/main/mongobleed.py

by gpi

12/26/2025 at 10:14:10 PM

Current link points straight to the Python code without a lot of context, so here’s the top of the readme:

> CVE-2025-14847 - MongoDB Unauthenticated Memory Leak Exploit

> A proof-of-concept exploit for the MongoDB zlib decompression vulnerability that allows unauthenticated attackers to leak sensitive server memory.

by FridgeSeal

12/26/2025 at 9:17:47 PM

Do people usually run Mongo in a mode that allows unauthenticated calls? I don’t know anything about Mongo. This just seems surprising.

by dpark

12/26/2025 at 9:46:09 PM

No, but it's pretty common IME to create an Atlas cluster that has internet-wide access (0.0.0.0/0) when testing and forgetting to turn this off. According to https://jira.mongodb.org/browse/SERVER-115508, this affects unauthenticated ops. Based on the repro code itself, it looks like this happens way before authentication is checked for the corresponding OP at the OP_MSG decoding level.

So if you're using Atlas, check that your Cluster has auto upgraded already. If you're using 0.0.0.0/0, stop doing that and prefer a limited IP address range and even better, use VPC Peering or other security/network boundary features.

by erdaniels

12/26/2025 at 10:06:11 PM

We received communication that all Atlas clusters were upgraded with the fix before the vulnerability was announced.

by computerfan494

12/27/2025 at 12:19:00 AM

This is a good example of a benefit of certificate-based authentication option for MongoDB, because you need to at least present a valid client certificate to transmit any data.

by yearolinuxdsktp

12/29/2025 at 5:29:34 PM

> No, but it's pretty common IME to create an Atlas cluster that has internet-wide access (0.0.0.0/0) when testing and forgetting to turn this off.

That is a ridiculous default.

by nailer

12/26/2025 at 9:26:35 PM

Its default is to only take connections that are local, usually I have my mongo clients SSH into a mongo server as opposed to opening up the port to the internet. Some Mongo users / collections are very open by default.

It has been a minute since I used Mongo for production grade projects, so some things could have changed since then.

by giancarlostoro

12/27/2025 at 3:15:35 AM

I don't think I would be comfortable serving any DB over the internet these days, exploit scanners are so agressand ubiquitous that a breach would feel inevitable.

Not that it is fool proof, but if I am setting up the infrastructure I can probably control where the DB is deployed, so I would colocate it with the application servers on a local network or virtual local network, that is all I would be comfortable with.

by ehnto

12/27/2025 at 8:21:09 PM

When vulnerability description says “unauthenticated exploit” that means that you can exploit without being required to authenticate first. It means it just works even with authentication being required on the server.

When it says “authenticated exploit” it means you need to pass authentication first in order to trigger exploit whatever it may be.

by winstonwinston

12/28/2025 at 12:37:44 PM

What an awful vulnerability. The most interesting fact is that this has been there since the PR that introduced it in 2017[1].

I'm not sure how Mongo's review process works, but it seems like this one had zero review.

[1] - https://github.com/mongodb/mongo/pull/1152

by enether

12/28/2025 at 2:37:56 PM

This is astronomical. If I correctly understood, the full on compromise of Ubisoft happened because of this.

by FrostKiwi

12/28/2025 at 4:32:03 PM

The problem is that about 20% of mongodb users are still on v4 for which not patch has been provided since it reach end of support on Feb 2024...

by spaquet

12/26/2025 at 11:27:22 PM

Luckily most people wouldn't use zlib anyway, they'd use snappy or zstd, and this also requires authenticated access to the cluster ....

by winrid

12/27/2025 at 2:07:24 AM

> authenticated access to the cluster

No it doesn’t.

> they'd use snappy or zstd

What is being used more doesn’t matter, what’s compiled in and enabled matters.

by mirashii