CVE-2025-34299: Monsta FTP RCE Vulnerability

CVE-2025-34299 Overview

CVE-2025-34299 is a critical unauthenticated arbitrary file upload vulnerability affecting Monsta FTP versions 2.11 and earlier. This flaw enables attackers to achieve remote code execution by uploading specially crafted files through a malicious (S)FTP server connection. The vulnerability requires no authentication, making it particularly dangerous for internet-facing Monsta FTP installations.

Critical Impact

Attackers can execute arbitrary code on vulnerable systems without authentication by leveraging malicious file uploads from a controlled (S)FTP server, potentially leading to complete system compromise.

Affected Products

• Monsta FTP version 2.11 and all earlier versions
• All installations of monstaftp:monsta_ftp prior to patched releases

Discovery Timeline

• 2025-11-07 - CVE-2025-34299 published to NVD
• 2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-34299

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). Monsta FTP fails to properly validate and restrict file uploads when processing files from connected (S)FTP servers. The web-based FTP client does not implement adequate security controls to prevent the upload of executable or otherwise dangerous file types to the server hosting Monsta FTP.

The attack scenario involves an attacker setting up a malicious (S)FTP server containing a specially crafted payload file. When a Monsta FTP instance connects to this malicious server (or is tricked into doing so), the attacker can leverage the arbitrary file upload capability to place malicious files, such as PHP webshells, directly onto the target web server. Since the upload occurs without authentication requirements, the attack surface is significantly expanded.

Root Cause

The root cause of CVE-2025-34299 lies in insufficient input validation and access control mechanisms within the Monsta FTP application. The software fails to:

1. Properly sanitize and validate uploaded file types
2. Restrict file uploads to safe locations outside the web root
3. Implement authentication requirements for file transfer operations
4. Validate the source and integrity of files being transferred from connected (S)FTP servers

Attack Vector

The attack leverages the network-accessible nature of Monsta FTP. An attacker can exploit this vulnerability by:

1. Setting up a malicious (S)FTP server containing a crafted payload (e.g., PHP webshell)
2. Tricking a Monsta FTP user into connecting to the malicious server, or exploiting scenarios where the vulnerable instance can be made to connect to attacker-controlled infrastructure
3. Uploading the malicious file through the vulnerable file transfer functionality
4. Executing the uploaded payload to achieve remote code execution on the target system

The vulnerability manifests in the file upload handling mechanism where dangerous file types are not properly filtered or restricted. For detailed technical analysis, see the WatchTowr Analysis on CVE-2025-34299 and the VulnCheck Advisory on Monsta FTP.

Detection Methods for CVE-2025-34299

Indicators of Compromise

• Presence of unexpected PHP files or webshells in web-accessible directories
• Unusual file uploads to the Monsta FTP installation directory
• Suspicious outbound connections from the web server to unknown (S)FTP servers
• Web server access logs showing requests to newly created executable files

Detection Strategies

• Monitor web server directories for unauthorized file creations, particularly PHP, JSP, or other executable file types
• Implement file integrity monitoring (FIM) on the Monsta FTP installation directory
• Review web server access logs for suspicious POST requests and file upload activity
• Deploy web application firewalls (WAF) with rules to detect and block malicious file upload attempts

Monitoring Recommendations

• Enable detailed logging for all file transfer operations within Monsta FTP
• Configure alerts for file creation events in web-accessible directories
• Monitor network traffic for connections to unexpected (S)FTP servers
• Implement endpoint detection and response (EDR) solutions to detect post-exploitation activities

How to Mitigate CVE-2025-34299

Immediate Actions Required

• Upgrade Monsta FTP to a patched version immediately (versions after 2.11 with security fixes applied)
• Restrict network access to Monsta FTP installations using firewall rules
• Audit existing Monsta FTP installations for signs of compromise
• Consider taking vulnerable instances offline until patching is complete

Patch Information

Organizations should upgrade to the latest version of Monsta FTP that addresses this vulnerability. Check the Monsta FTP Notes for official release information and security updates. It is critical to apply patches promptly given the unauthenticated nature of this vulnerability and the high EPSS score of 55.934% (98th percentile), indicating a high probability of exploitation in the wild.

Workarounds

• Place Monsta FTP behind a reverse proxy with strict access controls and authentication requirements
• Implement network segmentation to limit access to Monsta FTP instances
• Configure web server settings to prevent execution of uploaded files (e.g., disable PHP execution in upload directories)
• Use application-level firewalls to restrict file upload types

# Example Apache configuration to disable PHP execution in upload directories
<Directory "/var/www/html/monstaftp/uploads">
    php_admin_flag engine off
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>