Executive brief
Monsta FTP, a web-based FTP client, is vulnerable to a security flaw that allows unauthorized individuals to trick the server into making requests to internal systems. By bypassing security filters, an attacker could access sensitive internal data, such as cloud server credentials or private network services, that are normally hidden from the internet. This could lead to a full compromise of the server's hosting environment or the theft of sensitive configuration data.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the 'fetchRemoteFile' action of Monsta FTP due to an incomplete IP blocklist check in the 'isBlockedIP()' function. The function fails to properly validate IPv4-mapped IPv6 addresses, allowing attackers to bypass restrictions intended to prevent access to local or internal IP ranges. An unauthenticated attacker can first retrieve a CSRF token from the 'getSystemVars' endpoint and then submit a crafted request using an IPv4-mapped address. This forces the server to perform HTTP requests to internal services (such as cloud metadata endpoints) and exfiltrate the responses to an attacker-controlled FTP destination. The issue is resolved in version 2.14.5.
Affected products
- Monsta Limited of New Zealand Monsta FTP before 2.14.5
Timeline
- 2026-07-02: patched: Version 2.14.5 released to address the issue.
- 2026-07-08: disclosed: Vulnerability details and CVE-2026-60105 published.