kre80r/cve-2025-34299-labDocker test environment for CVE-2025-34299 - Monsta FTP Pre-Auth RCE vulnerability
Docker test environment for CVE-2025-34299 - Monsta FTP Pre-Authentication Remote Code Execution vulnerability.
| Field | Value |
|---|---|
| CVE ID | CVE-2025-34299 |
| Severity | Critical (CVSS 9.8) |
| CWE | CWE-434 (Unrestricted Upload of File with Dangerous Type) |
| Affected Versions | <= 2.11.2 |
| Patched Version | 2.11.3 |
| KEV | Yes |
Monsta FTP versions <= 2.11.2 contain a pre-authenticated remote code execution vulnerability via unrestricted arbitrary file upload. The downloadFile API endpoint (/mftp/application/api/api.php) accepts user-controlled file paths without proper sanitization, allowing attackers to:
actionName: downloadFile# Clone this repository
git clone https://github.com/KrE80r/CVE-2025-34299-lab.git
cd CVE-2025-34299-lab
# Start the vulnerable environment
docker-compose up -d
# Verify it's running
curl -s http://localhost:8080/mftp/ | grep -o "MonstaFTP"
# Test with nuclei template
nuclei -t CVE-2025-34299.yaml -u http://localhost:8080
# Expected output:
# [CVE-2025-34299] [http] [critical] http://localhost:8080/mftp/application/api/api.php ["2.10.4"]
# Check if the vulnerable API endpoint is accessible
curl -X POST http://localhost:8080/mftp/application/api/api.php \
-H "Content-Type: application/x-www-form-urlencoded" \
-d 'request={"connectionType":"ftp","configuration":{"host":"127.0.0.1","username":"test","initialDirectory":"/","password":"test","port":21},"actionName":"downloadFile","context":{"remotePath":"/test.txt","localPath":"/tmp/test.txt"}}'
# Expected response contains "CONNECTION_FAILURE_ERROR" proving the vulnerable code path is reached
# Stop and remove the container
docker-compose down
# Remove the image
docker rmi cve-2025-34299-lab-monsta-ftp-vulnerable
This environment is provided for security research and testing purposes only. Do not use against systems you do not own or have explicit permission to test.
MIT License