MongoDB Improper Handling of Length Parameter Inconsistency (CVE-2025-14847)

union isfuzzy=true
(
  MongoDBDiagnosticLogs
  | where TimeGenerated >= ago(24h)
  | where Message has_any ("length", "BSONObj", "invalid", "assertion", "exception", "malformed")
  | where Message matches regex @"(?i)(length.*inconsisten|param.*mismatch|bson.*invalid|buffer.*overflow|assertion.*failed)"
  | project TimeGenerated, Computer, Message, Severity
),
(
  Syslog
  | where TimeGenerated >= ago(24h)
  | where ProcessName has_any ("mongod", "mongos")
  | where SyslogMessage has_any ("length", "assertion", "exception", "invalid", "malformed")
  | where SyslogMessage matches regex @"(?i)(length.*inconsisten|param.*mismatch|bson.*invalid|assertion.*failed)"
  | project TimeGenerated, Computer, ProcessName, SyslogMessage
),
(
  CommonSecurityLog
  | where TimeGenerated >= ago(24h)
  | where DestinationPort in (27017, 27018, 27019)
  | where Message has_any ("length", "malformed", "invalid", "error")
  | project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, DestinationPort, Message
)
| sort by TimeGenerated desc

index=* sourcetype IN ("mongod", "mongodb", "mongodb:diagnostic", "syslog") earliest=-24h
| where match(_raw, "(?i)(length.*inconsisten|param.*mismatch|bson.*invalid|assertion.*failed|malformed.*request)")
  OR (match(host, "(?i)mongo") AND match(_raw, "(?i)(exception|error|assertion)"))
| eval risk_score=case(
    match(_raw, "(?i)(assertion|malformed)"), 80,
    match(_raw, "(?i)(length.*inconsisten|bson.*invalid)"), 90,
    true(), 50
  )
| stats count as event_count, max(risk_score) as max_risk, values(_raw) as raw_events, dc(host) as unique_hosts by host, sourcetype
| where event_count > 1 OR max_risk >= 80
| sort - max_risk

sequence by host.name with maxspan=5m
  [process where process.name in ("mongod", "mongos") and
   event.type == "start"]
  [any where
   (data_stream.dataset : "mongodb.*" or log.logger : "mongod") and
   (
     message : "*length*inconsisten*" or
     message : "*BSONObj*invalid*" or
     message : "*assertion*failed*" or
     message : "*malformed*request*" or
     message : "*param*mismatch*"
   )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  logsourcename(logsourceid) AS log_source,
  UTF8(payload) AS raw_payload,
  QIDNAME(qid) AS event_name
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('MongoDB', 'Linux Syslog', 'Universal DSM')
  AND (
    UTF8(payload) ILIKE '%length%inconsisten%'
    OR UTF8(payload) ILIKE '%BSONObj%invalid%'
    OR UTF8(payload) ILIKE '%assertion%failed%'
    OR UTF8(payload) ILIKE '%malformed%request%'
    OR (destinationport IN (27017, 27018, 27019) AND UTF8(payload) ILIKE '%error%')
  )
  AND LOGSOURCETYPENAME(devicetype) ILIKE '%mongo%'
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=mongodb* OR _sourceCategory=*mongod* OR _sourceName=*mongod*
| where _raw matches /(?i)(length.*inconsisten|bson.*invalid|assertion.*failed|malformed.*request|param.*mismatch)/
| parse regex "(?P<severity>WARNING|ERROR|SEVERE|FATAL)" nodrop
| parse regex "(?P<component>\w+)\s+\[" nodrop
| timeslice 5m
| count by _timeslice, _sourceHost, severity, component
| where _count > 0
| sort by _timeslice desc

rule cve_2025_14847_mongodb_length_param_inconsistency {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-14847 MongoDB length parameter inconsistency exploitation"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://jira.mongodb.org/browse/SERVER-115508"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    (
      $log.metadata.product_name = /(?i)mongodb/ or
      $log.principal.process.file.full_path = /(?i)(mongod|mongos)/
    )
    and
    (
      $log.metadata.description = /(?i)(length.*inconsisten|bson.*invalid|assertion.*failed|malformed|param.*mismatch)/ or
      $log.security_result.description = /(?i)(length.*inconsisten|bson.*invalid|assertion.*failed)/
    )

  condition:
    $log
}

#event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2", "NetworkConnectIP4", "DnsRequest")
| ImageFileName CONTAINS "mongod" OR ImageFileName CONTAINS "mongos"
  OR (RemotePort IN ["27017", "27018", "27019"] AND (CommandLine CONTAINS "mongo" OR ParentBaseFileName CONTAINS "mongod"))
| eval threat_indicator=if(
    CommandLine MATCHES "(?i).*(--eval|--shell|javascript).*",
    "suspicious_mongo_cli",
    if(RemotePort IN ["27017", "27018", "27019"], "mongo_port_access", "mongo_process")
  )
| stats count() AS event_count, values(RemoteIP) AS remote_ips, values(CommandLine) AS commands BY ComputerName, ImageFileName, threat_indicator
| where event_count > 0
| sort - event_count