CVE-2025-34299
📋 TL;DR
CVE-2025-34299 is an unauthenticated arbitrary file upload vulnerability in Monsta FTP versions 2.11 and earlier. Attackers can exploit this by connecting from a malicious FTP/SFTP server to upload arbitrary files, leading to remote code execution. Organizations using vulnerable Monsta FTP installations are affected.
💻 Affected Systems
- Monsta FTP
📦 What is this software?
Monsta Ftp by Monstaftp
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the server, data exfiltration, ransomware deployment, and lateral movement within the network.
Likely Case
Remote code execution leading to web shell installation, data theft, and potential use as an initial access vector for further attacks.
If Mitigated
Limited impact if proper network segmentation, file upload restrictions, and monitoring are in place, though the vulnerability remains dangerous.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. Attackers only need to connect from a malicious FTP/SFTP server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.12 or later
Vendor Advisory: https://www.monstaftp.com/notes/
Restart Required: Yes
Instructions:
1. Download Monsta FTP version 2.12 or later from the official website. 2. Backup your current installation. 3. Replace the existing files with the updated version. 4. Restart the web server/service.
🔧 Temporary Workarounds
Disable Monsta FTP
allTemporarily disable Monsta FTP until patching is possible
# For Apache: sudo a2dissite monstaftp.conf
# For Nginx: rm /etc/nginx/sites-enabled/monstaftp
# Or move the Monsta FTP directory: mv /var/www/monstaftp /var/www/monstaftp_disabled
Restrict Network Access
linuxLimit access to Monsta FTP using firewall rules
# iptables example: sudo iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
# iptables example: sudo iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
# Then: sudo iptables -A INPUT -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Monsta FTP instances from critical systems
- Deploy a web application firewall (WAF) with rules to block file upload patterns and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check the Monsta FTP version in the admin interface or by examining the source code files. Look for version numbers 2.11 or lower.Check Version:
grep -r 'version' /path/to/monstaftp/installation/ | grep -i '2.11\|2.10\|2.9'Verify Fix Applied:
Verify the version has been updated to 2.12 or later in the admin interface. Test that file uploads from untrusted FTP/SFTP servers are properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to Monsta FTP directories
- Suspicious FTP/SFTP connection attempts from unknown IPs
- Web shell creation in web-accessible directories
- Execution of unexpected PHP or other script files
Network Indicators:
- Outbound connections from Monsta FTP server to unknown IPs
- Unusual spikes in traffic to Monsta FTP port
- File upload requests containing executable content
SIEM Query:
source="monstaftp.log" AND (event="file_upload" AND file_extension IN ("php", "jsp", "asp", "exe")) OR (event="connection" AND source_ip NOT IN (trusted_ips))