Updated MongoDB memory disclosure module (CVE-2025-14847)

[xaitax]

New Features Added

1. CHECK Action (Wiz Magic Packet)

   • Quick vulnerability detection using single crafted packet
   • Based on Wiz Research Nuclei template technique
   • set ACTION CHECK then run

2. Compression Pre-flight Check

   • Detects server's supported compressors via hello command
   • Warns/stops if zlib not enabled (required for CVE)
   • Displays available compressors

3. Connection Reuse

   • New REUSE_CONNECTION option (default: true)
   • Persistent TCP connection instead of reconnect per probe
   • Significant speed improvement

4. Improved Leak Extraction

   • Printable ASCII sequences (6+ chars)
   • MongoDB connection string patterns (mongodb://)
   • JSON/BSON fragment detection
   • Broader quoted string extraction

5. JSON Export

   • New SAVE_JSON option (default: true)
   • Structured report with offsets, base64 data, timestamps, secrets
   • Machine-parseable for automation

[jvoisin]

Why set ACTION instead of using check and run directly?

[xaitax]

AFAIK doesn't exist for aux.

[jvoisin]

I think we can be even cooler here and use something like Zlib::Deflate.deflate("{\"a\": 1}")

[jvoisin]

There are already a handful of mongodb modules in metasploit, it would make sense to split the fingerprinting parts of this functions into a mixin.