keraattin/Mongobleed-Detector-CVE-2025-14847

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a vulnerability scanner for CVE-2025-14847 (MongoBleed). It connects to MongoDB servers, detects their version and zlib compression status, and reports whether they are vulnerable based on a hardcoded version database. It does not exploit the vulnerability or read memory.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and a Python scanner script for CVE-2025-14847. The script performs network connections to detect MongoDB versions and zlib compression status, and exports results. No backdoor, trojan, or deceptive behavior was observed. The code's functionality is consistent with its documented purpose as a vulnerability scanner.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareMongoDB Server
Attack typesvulnerability scanning
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code's primary operation is to detect and report the presence of CVE-2025-14847 by checking server version and zlib status. It does not contain any code to trigger the memory leak, read uninitialized memory, or exfiltrate data. The README explicitly describes it as a 'vulnerability scanner' and the code only performs detection and reporting.

README.md:3mongobleed_detector.py:4-6mongobleed_detector.py:532-587

Requirements

  • Network access to target MongoDB port (default 27017)README.md:67
  • Python 3.7 or higherREADME.md:66

Observed behavior

  • Connects to a MongoDB server and sends 'hello' and 'buildInfo' commands to determine the server version.mongobleed_detector.py:462-472
  • Sends a zlib-compressed OP_COMPRESSED ping message to check if zlib compression is enabled on the server.mongobleed_detector.py:500-526
  • Compares the detected version and zlib status against a hardcoded vulnerability database to determine if the target is vulnerable, safe, or mitigated.mongobleed_detector.py:61-71mongobleed_detector.py:371-412
  • Outputs a scan report to the console and optionally exports results to TXT, JSON, or CSV files.mongobleed_detector.py:610-638mongobleed_detector.py:697-775
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
socket.connect((host, port))The scanner connects to user-supplied MongoDB targets on the default port 27017 or a custom port to send 'hello' and 'buildInfo' commands and check zlib compression. This is expected behavior for a vulnerability scanner.mongobleed_detector.py:460mongobleed_detector.py:507
Data Exfiltration
Export results to TXT, JSON, or CSV filesThe script can write scan results to a local file specified by the user via the -o flag. This is a documented feature for reporting and does not involve sending data to an external server.mongobleed_detector.py:697-775
Review boundaries

What the analysis did not establish

  • One file (likely a license or configuration file) was omitted from the text evidence, but the two provided files (README.md and mongobleed_detector.py) constitute the complete functional code and documentation.
  • The evidence does not include the execution of the code; classification is based solely on static analysis of the provided source text.
  • One file (unclassified, 4688 bytes) was present in the artifact but not provided as readable text; its content is unknown.
  • Binary files were flagged for metadata only and not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1