CVE-2025-34299

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

How does this detection method work?

This detection template works by sending a GET request to the target URL, checking if the response contains Monsta FTP with a 200 status code, extracting the version from the title tag using regex, and then comparing it against version 2.11 to identify vulnerable instances.

<img src="https://raw.githubusercontent.com/Tarikul-Islam-Anik/Animated-Fluent-Emojis/master/Emojis/Travel%20and%20places/Rocket.png" alt="Rocket" width="25" height="25" /> How do I run this script?

1. Download and install Nuclei.
2. Clone this repostory to your local system.
3. Run the following command:

nuclei -u <ip|fqdn> -t template.yaml