Listen to this Post
The vulnerability resides in the `/mftp/application/api/api.php` endpoint, which handles file download requests. An attacker sends a crafted POST request containing an `actionName` of `fetchRemoteFile` or downloadFile. This request forces the Monsta FTP application to connect to an attacker-controlled (S)FTP server specified in the `configuration` host parameter. The attacker supplies a malicious file (like a PHP web shell) on their server. Crucially, the `localPath` parameter within the request context is not validated. This allows the attacker to specify an arbitrary, writable destination path on the target server’s filesystem, such as the web root /var/www/html/mftp/. When Monsta FTP executes the `downloadFile` action, it retrieves the malicious file from the attacker’s server and saves it to the chosen location. The written file can then be accessed via HTTP, leading to arbitrary remote code execution with web server privileges.
Platform: Monsta FTP
Version: <= 2.11
Vulnerability: Unauthenticated Arbitrary File Upload
Severity: Critical
date: 2025-11-07
Prediction: Patch already released
What Undercode Say:
Showing bash commands and codes related to the blog
Query to find vulnerable systems with runZero _asset.protocol:http AND protocol:http AND favicon.ico.image.mmh3:="1535999103" Example exploit Python command python3 exploit.py http://target/mftp Build vulnerable lab with Docker docker build -t monsta-ftp:2.10.4 . docker run -d -p 8080:80 monsta-ftp:2.10.4
How Exploit:
Attacker sends crafted POST to /mftp/application/api/api.php. The request tricks Monsta FTP into connecting to a malicious SFTP/FTP server. A malicious file (e.g., PHP shell) is downloaded and written to a user-controlled `localPath` on the server. The attacker accesses the uploaded file via web to execute commands.
Protection from this CVE
Update to version 2.11.3 or later. Restrict network access to the API endpoint (/mftp/application/api/api.php). Implement a Web Application Firewall (WAF) with input validation rules. Harden server configurations and use least privileges.
Impact:
Complete system compromise via Remote Code Execution (RCE). Attackers can install backdoors, exfiltrate data, or pivot within networks. No authentication is required for exploitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
