CVE-2026-60105: Monsta FTP SSRF Vulnerability – Unauthenticated Credential Exfiltration

Technical summary

CVE-2026-60105 is an SSRF vulnerability in the fetchRemoteFile action of Monsta FTP. The root cause lies in the isBlockedIP() function's incomplete validation of the IP blocklist. The function fails to detect IPv4 addresses that are encoded within IPv4-mapped IPv6 address notation (::ffff:a.b.c.d), a bypass technique that allows attackers to circumvent IP-based access controls. An attacker first retrieves a CSRF token via the unauthenticated getSystemVars endpoint, then submits a malicious fetchRemoteFile request containing a source URL that resolves to an IPv4-mapped IPv6 address pointing to an internal service. The server processes this request, issues an HTTP call to the internal target, and writes the response to an attacker-specified FTP destination. This enables exfiltration of sensitive data, including cloud instance metadata credentials (IAM tokens, temporary credentials), which can lead to further compromise of the hosting environment.

Business impact

Organizations running Monsta FTP may face unauthorized access to internal services and cloud infrastructure credentials. If instance metadata services are accessible from the application server, attackers can retrieve temporary IAM credentials, API keys, or other secrets that grant access to cloud resources. The exposure of these credentials can enable lateral movement, data theft, resource hijacking, or deployment of malware within the cloud environment. Because the attack requires no authentication and can be executed remotely, the threat actor surface is broad. The attack also leaves audit trails in FTP access logs that may be difficult to correlate with the actual HTTP requests made to internal services, complicating incident detection and forensics.

Affected systems

Monsta FTP versions prior to 2.14.5 are vulnerable. Organizations should verify their installed version against the vendor documentation. The vulnerability affects all deployments regardless of OS, as it is an application-level flaw. Risk is highest for instances deployed in cloud environments (AWS, Azure, GCP) where metadata services are reachable, or in network segments where internal services (databases, configuration stores, monitoring systems) are accessible from the application tier.

Exploitability

The vulnerability is highly exploitable. It requires no authentication, no special user interaction, and the attack vector is network-based with low attack complexity. The attacker only needs to craft an HTTP request with a malicious URL; the CSRF token can be obtained passively from the public getSystemVars endpoint. The bypass of the IP blocklist is straightforward once the IPv4-mapped IPv6 encoding technique is understood. Public tools and libraries for IPv6 address manipulation are readily available. The CVSS 3.1 score of 8.6 (HIGH) reflects the ease of exploitation, broad attack surface, and high confidentiality impact. This vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest update, but the low barriers to exploitation mean defensive action should not be delayed pending KEV listing.

Remediation

Upgrade Monsta FTP to version 2.14.5 or later. This release includes a patched isBlockedIP() function that properly detects and blocks IPv4-mapped IPv6 addresses. Organizations unable to patch immediately should implement network-level mitigations: restrict outbound HTTP/HTTPS from the Monsta FTP application server to only necessary external destinations, disable or restrict access to cloud metadata services (169.254.169.254 on AWS, similar ranges on other clouds), and implement egress filtering rules that block requests to internal IP ranges and private subnets. Monitor FTP access logs for unusual destination IPs and fetchRemoteFile requests with IPv6 source parameters.

Patch guidance

Verify and apply Monsta FTP version 2.14.5 or later. The vendor advisory should specify the exact build and whether patches are available as binary downloads, package manager releases, or Docker images. Test the patch in a staging environment to confirm compatibility with your deployment model (standalone binary, container, reverse proxy configuration). After patching, restart the Monsta FTP service and verify that the getSystemVars endpoint and fetchRemoteFile action function normally. Review any custom integrations or automation scripts that may reference Monsta FTP endpoints to ensure they continue to work post-patch.

Detection guidance

Search application and web server logs for requests to the getSystemVars endpoint and fetchRemoteFile action. Look for fetchRemoteFile requests that contain IPv6 addresses (indicated by colons in the source URL parameter) or URLs with unusual IP formats. Monitor outbound HTTP/HTTPS connections from the Monsta FTP process to internal IP ranges, cloud metadata endpoints (169.254.169.254 on AWS, etc.), or non-standard ports. Review FTP server logs for successful uploads to remote destinations originating from Monsta FTP, especially if the data appears to contain credential material or JSON structures typical of cloud metadata responses. Implement alerting for any fetchRemoteFile invocation from unauthenticated sources. Network-based detection should flag outbound connections from the application server to metadata services or internal private IP ranges that originate from the Monsta FTP application.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.6), unauthenticated attack vector, and direct path to credential exfiltration in cloud environments. The bypass technique is simple, and the impact—obtaining cloud infrastructure credentials—can enable significant downstream attacks. Organizations in cloud-native environments face particularly acute risk. While not yet in the CISA KEV catalog, the vulnerability was published recently and patches are available; proactive patching provides strong defense.

Risk score, explained

CVSS 3.1 assigns a score of 8.6 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. The scoring reflects: (1) Network Attack Vector—no special access required; (2) Low Attack Complexity—the IPv6 bypass is straightforward; (3) No Privileges Required—the attack is unauthenticated; (4) No User Interaction—the attacker controls the full attack flow; (5) Scope Change—the vulnerability impacts not just Monsta FTP but the confidentiality of internal services it can reach; (6) High Confidentiality Impact—credentials and sensitive data from internal services and cloud metadata are exposed; (7) No Integrity or Availability Impact—this is a read-only exfiltration attack. The score reflects a severe vulnerability requiring urgent remediation.

Frequently asked questions