Improve mongobleed checks

[adfoster-r7]

Added multiple improvements to the cve_2025_14847_mongobleed.rb module, such as adding new a dedicated check method,improved compression support detection as only zlib can be exploited, and resolving other false positives

Verification

Check vuln

msf6 > use auxiliary/scanner/mongodb/cve_2025_14847_mongobleed
msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RHOSTS 192.168.1.100
RHOSTS => 192.168.1.100
msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > check

[+] 192.168.1.100:27017 - The target is vulnerable. Server leaks memory via crafted OP_COMPRESSED message (MongoDB 4.4.26)

Network issues now bubbled up correctly:

msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > recheck rhost=127.0.0.1
[*] Reloading module...
[*] 127.0.0.1:27017 - Cannot reliably check exploitability. Could not connect to the target
msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run rhost=127.0.0.1
[-] 127.0.0.1:27017       - Cannot reach 127.0.0.1:27017 - The connection was refused by the remote host (127.0.0.1:27017).
[*] 127.0.0.1:27017       - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) >

Check Not vuln - no zlib compression enabled

msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > recheck 192.168.123.144
[*] Reloading module...
[*] 192.168.123.144:27017 - The target is not exploitable. Server does not have zlib compression enabled (MongoDB 4.4.26)
msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > 

Check not vuln - patched

msf auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > check tcp://127.0.0.1:30000
[*] 127.0.0.1:30000 - The target is not exploitable. Version 8.2.6 is patched

[Copilot]

Pull request overview

This PR improves the CVE-2025-14847 “Mongobleed” MongoDB scanner by making the framework check workflow more accurate, reducing false positives against non-MongoDB services, and tightening zlib/compression handling.

Changes:

• Replaces the custom ACTION=CHECK flow with a standard scanner check_host implementation returning Exploit::CheckCode values.
• Improves compressor detection by negotiating hello/isMaster with a BSON array (and adds BSON array building support).
• Adds additional wire-protocol validation/sanity checks to reduce false positives and improve robustness.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
modules/auxiliary/scanner/mongodb/cve_2025_14847_mongobleed.rb	Adds standard check_host, strengthens protocol validation, and refines compression detection logic (zlib-focused).
documentation/modules/auxiliary/scanner/mongodb/cve_2025_14847_mongobleed.md	Updates usage docs to reflect the new check workflow and revised behavior/output.