Improve mongobleed checks

[adfoster-r7]

Added multiple improvements to the cve_2025_14847_mongobleed.rb module, such as adding new a dedicated check method,improved compression support detection as only zlib can be exploited, and resolving other false positives

Verification

Check vuln

msf6 > use auxiliary/scanner/mongodb/cve_2025_14847_mongobleed
msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RHOSTS 192.168.1.100
RHOSTS => 192.168.1.100
msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > check

[+] 192.168.1.100:27017 - The target is vulnerable. Server leaks memory via crafted OP_COMPRESSED message (MongoDB 4.4.26)

Network issues now bubbled up correctly:

msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > recheck rhost=127.0.0.1
[*] Reloading module...
[*] 127.0.0.1:27017 - Cannot reliably check exploitability. Could not connect to the target
msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run rhost=127.0.0.1
[-] 127.0.0.1:27017       - Cannot reach 127.0.0.1:27017 - The connection was refused by the remote host (127.0.0.1:27017).
[*] 127.0.0.1:27017       - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) >

Check Not vuln - no zlib compression enabled

msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > recheck 192.168.123.144
[*] Reloading module...
[*] 192.168.123.144:27017 - The target is not exploitable. Server does not have zlib compression enabled (MongoDB 4.4.26)
msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > 

Check not vuln - patched

msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > check tcp://127.0.0.1:30000
[*] 127.0.0.1:30000 - The target is not exploitable. Version 8.2.6 is patched

[Copilot]

Pull request overview

This PR improves the CVE-2025-14847 “Mongobleed” MongoDB scanner by making the framework check workflow more accurate, reducing false positives against non-MongoDB services, and tightening zlib/compression handling.

Changes:

• Replaces the custom ACTION=CHECK flow with a standard scanner check_host implementation returning Exploit::CheckCode values.
• Improves compressor detection by negotiating hello/isMaster with a BSON array (and adds BSON array building support).
• Adds additional wire-protocol validation/sanity checks to reduce false positives and improve robustness.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
modules/auxiliary/scanner/mongodb/cve_2025_14847_mongobleed.rb	Adds standard check_host, strengthens protocol validation, and refines compression detection logic (zlib-focused).
documentation/modules/auxiliary/scanner/mongodb/cve_2025_14847_mongobleed.md	Updates usage docs to reflect the new check workflow and revised behavior/output.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Copilot]

check_host performs get_server_compressors before returning early for patched versions. If the version lookup succeeds but the compression probe hits a transient connection error, the rescue will return CheckCode::Unknown even though we already know the version is patched. Consider checking vuln_status == :patched and returning Safe before making the additional network call, or handling compressor lookup failures in a way that doesn’t override a definitive version-based result.

[Copilot]

send_magic_packet_check attempts to zlib-inflate any OP_COMPRESSED response without checking the response’s compressorId. If the server replies with OP_COMPRESSED using snappy/zstd (or any non-zlib id), this will raise Zlib::Error and the method returns :unknown, making the check inconclusive. Parse and validate the compressorId byte (offset 24) and only inflate when it indicates zlib; otherwise handle the response in a way that preserves deterministic results (e.g., treat as inconclusive with an explicit reason).

[adfoster-r7]

Release Notes

Adds multiple improvements to the cve_2025_14847_mongobleed module, such as adding new a dedicated check method, improved compression support detection as only zlib can be exploited, and resolving other false positives