{
  "name": "HYBRID - MongoBleed - Unauthenticated Heap Memory Leak via zlib (CVE-2025-14847)",
  "enabled": true,
  "responsibleUserEmail": "francesco.cipollone@securityphoenix.com",
  "description": "Campaign logic: This campaign matches assets in one of three ways: (1) it finds vulnerable MongoDB Server deployments by matching the 'mongo' package in known vulnerable ranges across supported branches; (2) it catches any findings already tagged with CVE-2025-14847; (3) it catches findings labeled 'mongobleed'. Library matching is OR-based: any single vulnerable mongo version match is enough to include the asset. The client libraries 'pymongo' and 'motor' are included to surface application blast radius (services that connect to MongoDB) even when the server version is discovered elsewhere. Remediation: Patch is the fix. Upgrade MongoDB to a fixed version on the corresponding branch: 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30. Legacy branches 4.2/4.0/3.6 are end-of-life and should be moved to a supported branch. Compensating controls: if upgrade is delayed, disable zlib compression (remove zlib from networkMessageCompressors / net.compression.compressors; use Snappy/Zstd or disable compression) and remove direct internet exposure of port 27017 via network restrictions/allowlists. If the instance was internet-reachable, treat as potential secret disclosure and rotate credentials/tokens used by MongoDB and adjacent services.",
  "config": {
    "filters": [
      {
        "libraries": [
          { "name": "mongo", "version": ">=3.6 <4.0" },
          { "name": "mongo", "version": ">=4.0 <4.4.30" },
          { "name": "mongo", "version": ">=4.4 <4.4.30" },
          { "name": "mongo", "version": ">=5.0 <5.0.32" },
          { "name": "mongo", "version": ">=6.0 <6.0.27" },
          { "name": "mongo", "version": ">=7.0 <7.0.28" },
          { "name": "mongo", "version": ">=8.0 <8.0.17" },
          { "name": "mongo", "version": ">=8.2 <8.2.3" },

          { "name": "pymongo", "version": "*" },
          { "name": "motor", "version": "*" }
        ],
        "search": null,
        "cwes": null,
        "severityLevels": null,
        "assetLocality": null,
        "negateFilter": null
      },
      {
        "search": "mongobleed"
      },
      {
        "search": "CVE-2025-14847"
      }
    ]
  }
}