CVE-2021-40940
📋 TL;DR
Monstra CMS 3.0.4 has an unrestricted file upload vulnerability due to insufficient filtering of PHP file extensions. Attackers can upload malicious PHP files to execute arbitrary code on the server. All Monstra CMS 3.0.4 installations with file upload functionality are affected.
💻 Affected Systems
- Monstra CMS
📦 What is this software?
Monstra by Monstra
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Webshell installation allowing persistent backdoor access, data exfiltration, and lateral movement.
If Mitigated
Limited impact with proper file upload restrictions and web application firewalls in place.
🎯 Exploit Status
Exploitation requires authentication to access file upload functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.5
Vendor Advisory: https://github.com/monstra-cms/monstra/issues/471
Restart Required: No
Instructions:
1. Backup your Monstra installation. 2. Download Monstra 3.0.5 or later. 3. Replace all files except /public/uploads/ and /storage/ directories. 4. Clear browser cache.
🔧 Temporary Workarounds
Restrict File Upload Extensions
allConfigure web server to block PHP file uploads via case-insensitive filtering.
# Apache: Add to .htaccess
<FilesMatch "\.(?i:php|php3|php4|php5|phtml|phps)$">
Order Allow,Deny
Deny from all
</FilesMatch>
# Nginx: Add to server block
location ~* \.(php|php3|php4|php5|phtml|phps)$ {
deny all;
}
🧯 If You Can't Patch
- Disable file upload functionality completely in Monstra settings.
- Implement web application firewall (WAF) rules to block PHP file uploads.
🔍 How to Verify
Check if Vulnerable:
Check if running Monstra 3.0.4 by examining version files or admin panel.Check Version:
grep -r "version.*3.0.4" /path/to/monstra/ || cat /path/to/monstra/version.txtVerify Fix Applied:
Confirm version is 3.0.5 or later and test file upload with PHP extensions in various cases.📡 Detection & Monitoring
Log Indicators:
- File uploads with .php, .PHP, .Php extensions in web server logs
- Unusual POST requests to upload endpoints
Network Indicators:
- HTTP POST requests with PHP file uploads to Monstra paths
SIEM Query:
source="web_logs" (url="*/admin/index.php?id=filesmanager" OR url="*/ajax/upload") file_extension="*.php"