Monsta FTP is a popular web-based application used for managing FTP connections, primarily designed for web hosting environments, small businesses, and individuals needing to access file servers via a browser. It simplifies the process of transferring files to and from remote servers without requiring desktop-based FTP clients. Monsta FTP offers an easy-to-use and intuitive interface, making it accessible for users with various levels of technical expertise. Its lightweight and platform-independent nature allows it to be deployed across different operating systems. The software is particularly favored by users looking for a readily available, online FTP client solution. Being open-source, it provides flexibility for customization and integration with other web management tools.
The vulnerability in question is a Server-Side Request Forgery (SSRF) found in Monsta FTP versions up to 2.14.4. This type of vulnerability allows an attacker to craft requests from the server itself to internal or external services. It arises due to an insufficient blocklist check in the IP address parsing mechanism that bypasses IPv6 blocklists. SSRF vulnerabilities can lead to the disclosure of sensitive information, as they enable attackers to exploit the server's network privileges. An exploitable SSRF can be a critical gateway for attackers to pivot deeper into a network and access unauthorized resources. This is particularly dangerous as these requests often circumvent standard network-level restrictions.
In the technical details of the SSRF vulnerability in Monsta FTP, the issue resides in the 'fetchRemoteFile' action in conjunction with the 'isBlockedIP()' function. The blocklist intended to prevent IPv6-mapped addresses from being accessed is incomplete, allowing attackers to submit requests that resolve to internal IP addresses. The vulnerability permits an unauthenticated attacker to retrieve a CSRF token through the publicly accessible 'getSystemVars' endpoint. Consequently, an attacker can submit a malicious 'fetchRemoteFile' request, using crafted URLs to manipulate server behavior and access sensitive information controlled by the attacker's FTP destination.
When exploited by malicious actors, this vulnerability can have severe consequences. Attackers can make unauthorized HTTP requests to internal network services, leading to potential data breaches. Additionally, attackers might retrieve cloud instance metadata and credentials, compromising sensitive operational data. Exploiting SSRF could allow the attacker to escalate privileges within the network, facilitating further attacks or unauthorized operations. The system's integrity, confidentiality, and availability may be significantly impacted, driven by unauthorized access to internal services.
REFERENCES
- Upgrade Monsta FTP to version 2.14.5 or later to patch the SSRF vulnerability.
- Implement application layer protections to sanitize and validate remote address inputs thoroughly.
- Secure the internal network by restricting server access, ensuring that only legitimate requests can be sent.
- Conduct regular security assessments to identify and remediate similar vulnerabilities timely.
- Enable and enforce a policy of least privilege to restrict access to cloud instance metadata.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →