Monsta FTP SSRF via IPv4-mapped IPv6 Bypass

Executive Summary

This vulnerability exists in Monsta FTP versions before 2.14.5 and is a server-side request forgery (SSRF) issue in the fetchRemoteFile action. It is caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can exploit this by obtaining a CSRF token from the public getSystemVars endpoint and then submitting a fetchRemoteFile request with a source URL that resolves to an IPv4-mapped address. This causes the server to make HTTP requests to internal services and write the responses to an attacker-controlled FTP destination.

This allows the attacker to retrieve sensitive information such as cloud instance metadata credentials.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an unauthenticated attacker can exploit the SSRF flaw to make the server send HTTP requests to internal services that are normally inaccessible from outside. The attacker can then capture the responses by having them written to an FTP location they control.

This can lead to the disclosure of sensitive internal information, including cloud instance metadata credentials, which could be used to further compromise the system or cloud environment.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for unusual fetchRemoteFile requests that use IPv4-mapped IPv6 addresses to bypass IP blocklists. Specifically, look for HTTP requests originating from the Monsta FTP server targeting internal services or unusual FTP write destinations.

You can check for suspicious activity by inspecting web server logs or network traffic for fetchRemoteFile actions with source URLs containing IPv4-mapped IPv6 addresses (e.g., ::ffff:192.168.1.1).

Example commands to detect such activity might include:

• Using grep to find fetchRemoteFile requests in logs: grep -i 'fetchRemoteFile' /var/log/monsta_ftp/access.log
• Searching for IPv4-mapped IPv6 addresses in logs: grep -E '::ffff:[0-9]{1,3}(\.[0-9]{1,3}){3}' /var/log/monsta_ftp/access.log
• Using network monitoring tools like tcpdump or Wireshark to filter HTTP requests from the Monsta FTP server to internal IP ranges.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Monsta FTP to version 2.14.5 or later, where the incomplete IP blocklist check has been fixed.

Until an upgrade is possible, restrict access to the Monsta FTP server to trusted networks and users to reduce the risk of exploitation.

Additionally, monitor and block any fetchRemoteFile requests that use IPv4-mapped IPv6 addresses or unusual source URLs to prevent SSRF exploitation.

Useful 0 Not Useful 0