Monsta FTP Pre-Authentication Remote Code Execution via Arbitrary File Upload (CVE-2025-34299)

Metadata

Affected Target

Summary

Monsta FTP versions up to and including 2.11.2 contain a pre-authentication, unrestricted arbitrary file upload vulnerability (CWE-434) in the downloadFile action of its /mftp/application/api/api.php endpoint. The endpoint accepts a user-supplied FTP connection configuration and a remote/local path pair without requiring the caller to be authenticated and without adequately restricting where the “downloaded” file is written on the local filesystem. An attacker can point Monsta FTP at an FTP server they control, direct it to fetch a malicious file (e.g. a PHP webshell), and specify a localPath inside the web root, resulting in remote code execution with the privileges of the web server. This repository is a Docker-based lab (not a raw exploit script) that stands up a real, vulnerable Monsta FTP 2.10.4 instance for hands-on reproduction, plus a manual curl PoC that reaches the vulnerable code path and a reference to a nuclei detection template.

Vulnerability Details

Root Cause

The api.php endpoint dispatches actions based on an actionName parameter in a JSON-encoded request body, without first verifying that the caller is authenticated. One such action, downloadFile, accepts an FTP configuration block (host, port, credentials) plus a context object specifying remotePath (a path on the attacker-controlled FTP server) and localPath (where Monsta FTP should write the fetched file on the local web server filesystem). Because the endpoint is reachable pre-auth and does not adequately validate/sanitize the destination localPath or restrict the connection target, an attacker can:

• Stand up a malicious FTP server that serves a PHP webshell for any requested remotePath.
• Call downloadFile with that FTP server’s details and a localPath inside the web-accessible document root.
• Have Monsta FTP fetch the file over FTP and write it to that path, after which the attacker can request the dropped file via HTTP to execute it as PHP.

The lab’s manual verification request demonstrates reaching this exact code path:

1
2
3

curl -X POST http://localhost:8080/mftp/application/api/api.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'request={"connectionType":"ftp","configuration":{"host":"127.0.0.1","username":"test","initialDirectory":"/","password":"test","port":21},"actionName":"downloadFile","context":{"remotePath":"/test.txt","localPath":"/tmp/test.txt"}}'

A response containing CONNECTION_FAILURE_ERROR (rather than an authentication error) confirms the vulnerable code path is reachable without any credentials — the endpoint attempted the FTP connection instead of rejecting the request as unauthenticated.

Attack Vector

1. Attacker stands up a rogue FTP server that responds to file requests with a malicious PHP payload (e.g. a webshell).
2. Attacker sends an unauthenticated POST to the target’s /mftp/application/api/api.php with actionName: downloadFile, connectionType: ftp, and a configuration block pointing at the attacker’s FTP server.
3. The context.remotePath specifies the malicious file on the attacker’s FTP server; context.localPath specifies a destination path within the target’s web-accessible document root (e.g. under /mftp/).
4. Monsta FTP’s backend connects to the attacker’s FTP server and downloads/writes the file to the specified local path — with no authentication required and insufficient path/type validation.
5. Attacker requests the dropped file over HTTP, causing the web server to execute the uploaded PHP payload with the web server’s privileges.

Impact

Full pre-authentication remote code execution on the host running Monsta FTP, with the privileges of the web server process (e.g. www-data). This is a KEV-listed (per repo README) critical vulnerability requiring no credentials or user interaction.

Environment / Lab Setup

- Docker and Docker Compose
- Base image: php:7.4-apache
- Monsta FTP 2.10.4 (vulnerable version, fetched via Dockerfile from a web.archive.org
  mirror of the official installer zip) unpacked to /var/www/html/mftp
- PHP ftp extension enabled (docker-php-ext-install ftp), mod_rewrite enabled
- Exposes the app on host port 8080 -> container port 80
- Optional: nuclei with the CVE-2025-34299.yaml template for automated detection

Proof of Concept

PoC Script

See Dockerfile and docker-compose.yml in this folder (builds and runs a real vulnerable Monsta FTP 2.10.4 instance). No exploit script is included in the source repo — the repo provides a manual curl verification command and a nuclei template reference; actual weaponized file-write/webshell-drop exploitation is left to the operator using the documented downloadFile action.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

docker-compose up -d

curl -s http://TARGET:8080/mftp/ | grep -o "MonstaFTP"

curl -X POST http://TARGET:8080/mftp/application/api/api.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'request={"connectionType":"ftp","configuration":{"host":"127.0.0.1","username":"test","initialDirectory":"/","password":"test","port":21},"actionName":"downloadFile","context":{"remotePath":"/test.txt","localPath":"/tmp/test.txt"}}'
nuclei -t CVE-2025-34299.yaml -u http://TARGET:8080
docker-compose down
docker rmi cve-2025-34299-lab-monsta-ftp-vulnerable

Detection & Indicators of Compromise

- Unauthenticated POST requests to /mftp/application/api/api.php with
  actionName=downloadFile in the request body
- FTP connection attempts originating from the Monsta FTP host toward external/
  unexpected FTP servers immediately following such requests
- New files (especially .php) appearing under the Monsta FTP web root shortly after
  a downloadFile API call, particularly files not created via normal admin upload flows
- HTTP requests to newly created, unusual filenames under /mftp/ following the above
- Web server access logs showing execution of unfamiliar PHP files under the mftp
  install path

Signs of compromise:

• Unknown PHP files (webshells) present in the Monsta FTP install directory
• Outbound FTP connections from the web server host to unfamiliar external IPs
• api.php requests with actionName":"downloadFile" from unauthenticated/anonymous sessions in access logs
• Unexpected www-data (or equivalent) process activity following HTTP requests to newly dropped files

Remediation

References

• Source repository
• NVD - CVE-2025-34299
• WatchTowr Labs Advisory
• GitHub Advisory - GHSA-42m5-3r2p-wr92

Notes

Mirrored from https://github.com/KrE80r/CVE-2025-34299-lab on 2026-07-06. This repo is a Dockerfile + docker-compose lab standing up a real vulnerable Monsta FTP 2.10.4 instance, with a manual curl PoC that confirms the pre-auth vulnerable code path and a reference to an external nuclei template (CVE-2025-34299.yaml, not bundled in this repo) for automated detection.