CVE-2025-13643
📋 TL;DR
A privilege escalation vulnerability in MongoDB Server allows users with limited privileges to terminate queries executed by other users, causing denial of service by preventing queries from completing. This affects MongoDB Server v7.0 before 7.0.26 and v8.0 before 8.0.14. The vulnerability requires authenticated access to the cluster.
💻 Affected Systems
- MongoDB Server
📦 What is this software?
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
⚠️ Risk & Real-World Impact
Worst Case
Malicious or compromised users with minimal privileges could systematically terminate critical database queries, causing widespread service disruption and data processing failures.
Likely Case
Accidental or intentional termination of queries by users with limited privileges, causing intermittent query failures and degraded database performance.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated query failures that can be quickly detected and remediated.
🎯 Exploit Status
Exploitation requires authenticated access to MongoDB with specific privilege actions. The vulnerability is documented in MongoDB's internal tracking system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v7.0.26 or v8.0.14
Vendor Advisory: https://jira.mongodb.org/browse/SERVER-103582
Restart Required: Yes
Instructions:
1. Download MongoDB Server v7.0.26 or v8.0.14 from official MongoDB website. 2. Stop the MongoDB service. 3. Backup your data and configuration. 4. Install the updated version. 5. Restart the MongoDB service. 6. Verify the version is updated.
🔧 Temporary Workarounds
Restrict User Privileges
allReview and limit user privileges to prevent unauthorized query termination actions.
db.revokeRolesFromUser("username", [ { role: "killAnyCursor", db: "admin" } ])
Implement Query Monitoring
allMonitor and alert on unexpected query terminations using MongoDB's auditing features.
db.adminCommand({setParameter: 1, auditAuthorizationSuccess: true})
🧯 If You Can't Patch
- Implement strict role-based access control to limit who can execute query termination operations
- Enable comprehensive auditing and monitoring to detect and respond to unauthorized query terminations
🔍 How to Verify
Check if Vulnerable:
Connect to MongoDB and run: db.version(). Check if version is between v7.0.0-7.0.25 or v8.0.0-8.0.13Check Version:
db.version()Verify Fix Applied:
After patching, run: db.version() and verify version is v7.0.26 or higher, or v8.0.14 or higher📡 Detection & Monitoring
Log Indicators:
- Unexpected query termination events in MongoDB logs
- killCursors operations from unauthorized users
- Failed queries with termination errors
Network Indicators:
- Unusual killCursors command patterns in MongoDB protocol traffic
SIEM Query:
source="mongodb.log" AND ("killCursors" OR "query terminated") AND NOT user="authorized_user"