Monsta web-based FTP Remote Code Execution Vulnerability Exploited
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A critical remote code execution vulnerability in Monsta FTP, a popular web-based FTP client used by financial institutions and enterprises worldwide.<\/p>\n
The flaw, now tracked as\u00a0CVE-2025-34299<\/a>, affects multiple versions of the software and has been exploited in the wild.<\/p>\n Monsta FTP is a browser-based file transfer client that allows users to manage files on remote servers without dedicated FTP software.<\/p>\n With at least 5,000 instances exposed on the internet, the platform serves a diverse user base, including financial organizations and large enterprises.<\/p>\n The security flaw enables attackers to achieve pre-authenticated remote code execution on vulnerable Monsta FTP servers<\/a>.<\/p>\n WatchTowr Labs researchers discovered that despite developers adding extensive input validation functions in recent updates, critical vulnerabilities remained unpatched across multiple versions.<\/p>\n The attack works through a simple three-step process: An attacker tricks Monsta FTP into connecting to a malicious SFTP server. Downloads a crafted payload file.<\/p>\n Writes that file to an arbitrary path<\/a> on the target server. This grants complete control over the vulnerable system.<\/p>\nThe Vulnerability and Patch Available<\/strong><\/h2>\n