EUVD-2026-42427
GHSA-hf3x-9vx4-94qv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated low-complexity network SSRF (PR:N/AC:L) with a scope change (S:C) as it reads other internal systems; confidentiality impact only (C:H), no integrity or availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.
AnalysisAI
Server-side request forgery in Monsta FTP before 2.14.5 lets an unauthenticated remote attacker coerce the server into making HTTP requests to internal-only services and exfiltrate the responses. The flaw lives in the fetchRemoteFile action, where the isBlockedIP() SSRF filter fails to recognize IPv4-mapped IPv6 addresses, so blocklisted internal ranges can be reached anyway; a CSRF token is trivially obtainable from the public getSystemVars endpoint. Impact is notable because the primary abuse case is stealing cloud instance metadata credentials, though no public exploit is identified at time of analysis.
Technical ContextAI
Monsta FTP is a PHP-based web FTP client that provides a fetchRemoteFile server-side action to download a user-supplied URL and relay it to a configured FTP destination - a classic SSRF-prone 'server fetches URL on client's behalf' pattern (CWE-918, Server-Side Request Forgery). The intended defense is isBlockedIP(), a blocklist that rejects internal/loopback/link-local ranges. The root cause is an incomplete-blocklist parsing bug: the check normalizes or inspects addresses as plain IPv4 but does not decode IPv4-mapped IPv6 addresses (the ::ffff:a.b.c.d form, and equivalently ::ffff:169.254.169.254), so an embedded internal IPv4 slips past the filter. Because the destination is written to an attacker-controlled FTP target, the response body - including the sensitive contents of internal endpoints such as the cloud metadata service at 169.254.169.254 - is captured rather than merely triggered blind.
RemediationAI
Vendor-released patch: 2.14.5 - upgrade Monsta FTP to 2.14.5 or later, which corrects the isBlockedIP() logic to detect IPv4-mapped IPv6 addresses; see the release notes at https://www.monstaftp.com/notes/ and the advisory at https://www.vulncheck.com/advisories/monsta-ftp-ssrf-via-ipv4-mapped-ipv6-address-bypass. If immediate patching is not possible, restrict network egress from the Monsta FTP host so it cannot reach the cloud metadata endpoint (block outbound access to 169.254.169.254 and other link-local/internal ranges at the host firewall or security group), which neutralizes the highest-impact credential-theft path but does not stop SSRF against other reachable internal services. On AWS, enforcing IMDSv2 (session-token required) blunts metadata theft even if the SSRF fires, at the cost of updating any tooling that relies on IMDSv1. Where the remote-fetch feature is not needed, disable or block the fetchRemoteFile action / place the application behind authentication and an allowlisting proxy; the trade-off is loss of the remote-file import functionality for legitimate users.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today