CVE-2025-6713 PoC — MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage

Source

Associated Vulnerability

Description

craft aggregation pipeline to access data without proper authorisation due to improper handling of $mergeCursors in MongoDB >v8.0 <8.0.7, >v7.0 <7.0.19, >v6.0 <6.0.22

Readme

# CVE-2025-6713

craft aggregation pipeline to access data without proper authorisation due to improper handling of $mergeCursors in MongoDB >v8.0 <8.0.7, >v7.0 <7.0.19, >v6.0 <6.0.22



## installation

not very difficult - just use pip3 to install the requirements: `pip install -r requirements`



## usage

```
python3 CVE-2025-6713
```



## tinkering

what do to to test it on your own

1. Line 4, 5, 6, 7, 9, 10:
   
   ```python
   mconnect = "mongodb://localhost:27017"
   dbname = ""
   acollection = ""
   rcollection = ""
   
   USERNAME = ""
   PASSWORD = ""
   ```
   
   you can:
   
   - change `mconnect` to your own mongo uri to connect to *your* database
   
   - change `dbname` to your db name (use, modify or fork the repo to have it test more than 1 db)
   
   - change `acollection` to a collection available publicly (accessible)
   
   - change `rcollection` to a collection not available publicly (restricted)
   
   - i think `USERNAME` & `PASSWORD` are common sense

2. Line 17 & 18 (in `setupTest(db)`, after `[acollection].insert_many([...`):
   
   ```json
   {"name": "pubthing1", "data": "pub stuff"},
   {"name": "pubthing2", "data": "pub stuff"}
   ```
   
   here, the script is just inserting test data into the db (does NOT have to be anything specific. it can literally be anything)

3. Line 22 & 23 (in `setupTest(db)`, after `[rcollection].insert_many([...`):
   
   ```json
   {"name": "secret", "stuff": "my national insurance number"},
   {"name": "shhhh", "boo": "location of pringles in my house"}
   ```
   
   this can also be literally anything too. have fun with it.

the rest - don't change unless you know what you're doing otherwise you'll just get confused and angry

File Snapshot

 [4.0K]  /data/pocs/a4e73bbd04c0ebf2d26135fef80cd6b005f41702
├── [2.1K]  CVE-2025-6713.py
├── [1.0K]  LICENSE
├── [1.7K]  README.md
└── [   8]  requirements.txt

0 directories, 4 files

Remarks