CVE-2026-60105: Monsta FTP SSRF Vulnerability

CVE-2026-60105 Overview

CVE-2026-60105 is a server-side request forgery (SSRF) vulnerability [CWE-918] affecting Monsta FTP versions before 2.14.5. The flaw resides in the fetchRemoteFile action, where the isBlockedIP() function performs an incomplete IP blocklist check. The function fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses, allowing attackers to bypass internal network restrictions. Unauthenticated attackers can retrieve a CSRF token from the public getSystemVars endpoint and issue requests that force the server to contact internal services. The vulnerability enables retrieval of cloud instance metadata credentials by writing HTTP responses to an attacker-controlled FTP destination.

Critical Impact
Unauthenticated attackers can extract cloud instance metadata credentials from internal endpoints, exposing IAM tokens and enabling downstream cloud account compromise.

Affected Products

Monsta FTP versions prior to 2.14.5
Deployments exposing the fetchRemoteFile action to untrusted networks
Cloud-hosted instances relying on IMDS (Instance Metadata Service) for credential distribution

Discovery Timeline

2026-07-08 - CVE-2026-60105 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-60105

Vulnerability Analysis

The vulnerability stems from an incomplete blocklist implementation in the isBlockedIP() function. The function inspects supplied hostnames and IP literals to reject requests targeting private, loopback, and link-local ranges. It does not normalize IPv4-mapped IPv6 addresses of the form ::ffff:169.254.169.254 back to their underlying IPv4 representation before comparison. As a result, attackers can supply a URL that resolves to an IPv4-mapped IPv6 address pointing to internal infrastructure. The server issues an outbound HTTP request to that address and writes the response body to a destination FTP server controlled by the attacker.

Root Cause

The root cause is improper input validation in the SSRF protection logic. The blocklist check operates on the string representation of the destination address rather than the canonical resolved IP. IPv4-mapped IPv6 addresses embed an IPv4 address inside a 128-bit IPv6 structure, and the socket layer still routes traffic to the embedded IPv4 destination. Because the validation function never normalizes the address family, private ranges reached through the IPv6 wrapper evade filtering.

Attack Vector

An unauthenticated remote attacker first requests the public getSystemVars endpoint to obtain a valid CSRF token. The attacker then submits a fetchRemoteFile request containing a source URL that resolves to an IPv4-mapped IPv6 address such as ::ffff:169.254.169.254. The Monsta FTP server issues an HTTP GET to the internal metadata service and streams the response to an attacker-controlled FTP endpoint specified in the request. This pattern extracts AWS, Azure, or GCP metadata credentials without authentication.

See the VulnCheck SSRF Advisory for detailed technical breakdown.

Detection Methods for CVE-2026-60105

Indicators of Compromise

Outbound HTTP requests from Monsta FTP hosts to metadata endpoints such as 169.254.169.254, metadata.google.internal, or 100.100.100.200
Access log entries showing sequential getSystemVars calls followed by fetchRemoteFile requests from the same client IP
Source URLs in fetchRemoteFile parameters containing ::ffff: prefixes or bracketed IPv6 literals resolving to private ranges
Outbound FTP connections from the Monsta FTP server to previously unseen external destinations

Detection Strategies

Inspect web server access logs for POST requests to fetchRemoteFile where the source parameter contains IPv6 syntax or link-local addresses
Monitor egress traffic from application servers for connections to RFC 1918, loopback, and cloud metadata address ranges
Alert on anomalous FTP client connections originating from web application hosts to internet destinations

Monitoring Recommendations

Enable full request body logging on the Monsta FTP endpoint to capture attacker-supplied URLs for forensic review
Correlate CSRF token issuance from getSystemVars with subsequent fetchRemoteFile submissions using the same session identifier
Deploy IMDSv2 enforcement on cloud instances and alert on any IMDSv1 requests, which indicate legacy or exploited access

How to Mitigate CVE-2026-60105

Immediate Actions Required

Upgrade Monsta FTP to version 2.14.5 or later immediately
Enforce IMDSv2 on all AWS EC2 instances hosting Monsta FTP to require session token authentication for metadata access
Restrict outbound network egress from Monsta FTP hosts to only required destinations using host firewalls or security groups
Rotate any IAM credentials, API keys, or tokens accessible from the affected instance metadata service

Patch Information

The vendor released a fix in Monsta FTP 2.14.5 that corrects the isBlockedIP() normalization logic. Refer to the MonstaFTP Notes for release details and upgrade instructions.

Workarounds

Place Monsta FTP behind a web application firewall configured to reject request parameters containing ::ffff: or bracketed IPv6 literals resolving to private ranges
Disable the fetchRemoteFile action if remote file retrieval is not required for business operations
Block outbound access to 169.254.0.0/16, 127.0.0.0/8, and RFC 1918 ranges at the network perimeter for the Monsta FTP host
Require authentication for the getSystemVars endpoint via reverse proxy access controls

bash

# Example egress restriction using iptables to block metadata service access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP

# Enforce IMDSv2 on AWS EC2
aws ec2 modify-instance-metadata-options \
  --instance-id i-EXAMPLE \
  --http-tokens required \
  --http-endpoint enabled