c137req/CVE-2025-6713

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that connects to a MongoDB instance, sets up test data in two collections, and executes an aggregation pipeline containing a $mergeCursors stage. It prints the results and checks for an 'not authorised' error to determine if the PoC succeeded or failed, functioning as a vulnerability scanner rather than a weaponized exploit.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates the CVE-2025-6713 vulnerability by using a crafted aggregation pipeline with $mergeCursors to read data from a restricted collection. All code is straightforward Python using the pymongo library. There is no obfuscation, no concealed executable behavior, no persistence mechanisms, no credential exfiltration, and no unrelated payloads. The script only connects to a user-supplied MongoDB instance, inserts test data, and runs the aggregation pipeline to demonstrate unauthorized data access.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareMongoDB Server
Attack typesImproper Authorization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary operation is to test for the presence of the vulnerability by executing a crafted aggregation pipeline and checking the response for an authorization error. It does not contain payloads to exfiltrate data, establish persistence, or perform any post-exploitation actions. The README describes it as a tool to 'test it on your own'.

CVE-2025-6713.py:55-68README.md:21-23

Requirements

  • A MongoDB instance with a user that has read access to a public collection but not to a restricted collection.CVE-2025-6713.py:6-12README.md:39-47
  • The pymongo Python library must be installed.requirements.txt:1

Observed behavior

  • Connects to a MongoDB instance using provided credentials.CVE-2025-6713.py:34
  • Drops and recreates two collections, inserting test data into each.CVE-2025-6713.py:14-26
  • Executes an aggregation pipeline on the accessible collection that uses $mergeCursors to reference the restricted collection.CVE-2025-6713.py:39-56
  • Prints the results of the aggregation and checks for an authorization error to report whether the PoC succeeded or failed.CVE-2025-6713.py:58-68
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
mongodb://localhost:27017The script connects to a MongoDB instance specified by the user. This is expected for a PoC that demonstrates a MongoDB vulnerability.CVE-2025-6713.py:6
Vulnerability Demonstration
Aggregation pipeline using $mergeCursors to access restricted collectionThe core of the PoC is an aggregation pipeline that uses the $mergeCursors stage to merge data from a restricted collection into an accessible one, demonstrating the CVE.CVE-2025-6713.py:39-56
Review boundaries

What the analysis did not establish

  • One file (4 total, 3 with content) was omitted from the evidence, so the analysis may be incomplete.
  • The evidence does not include the execution output of the script, so its effectiveness cannot be verified.
  • One file (unclassified, 1060 bytes) was not included as text and was analyzed via metadata only. Its content could not be reviewed, but the inventory reports no binary files and the selected text coverage is complete for the provided readable files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1