CyberRota Analysis
AI-GeneratedMonsta FTP versions prior to 2.14.5 are vulnerable to a server-side request forgery (SSRF) due to an inadequate IP blocklist check, allowing unauthenticated attackers to exploit the fetchRemoteFile action. This vulnerability can lead to unauthorized access to internal services and the potential exposure of sensitive cloud instance metadata credentials. Organizations using affected versions should prioritize patching to mitigate the risk of credential theft and unauthorized data access.
Original NVD Description
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.