KrE80r/CVE-2025-34299-lab

GitHubRepository PoCWriteup

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README and Dockerfile providing a test environment setup for CVE-2025-34299. It describes the vulnerability and how to verify the vulnerable endpoint is reachable, but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The repository contains only a Dockerfile and a README.md for setting up a vulnerable Monsta FTP test environment. No executable payload, obfuscated code, or concealed behavior is present. The Dockerfile downloads a known vulnerable version of Monsta FTP and the README provides standard documentation and testing instructions. No backdoor, trojan, or suspicious behavior is observed.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesDockerfileMarkdown
Target softwareMonsta FTP
Attack typesRemote Code ExecutionArbitrary File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact consists of a Dockerfile that sets up a vulnerable Monsta FTP instance and a README that documents the vulnerability and provides a manual verification curl command. It does not contain any code that automatically exploits the vulnerability or scans for it; it is a technical writeup with setup instructions.

README.md:1-89Dockerfile:1-28

Requirements

  • A running instance of Monsta FTP version 2.10.4 (vulnerable) is required for testing.README.md:63

Observed behavior

  • The README instructs users to send a POST request to the vulnerable API endpoint to verify it is reachable, expecting a CONNECTION_FAILURE_ERROR response.README.md:52-58
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Software Deployment
Monsta FTP 2.10.4 downloaded from web.archive.orgThe Dockerfile installs a vulnerable version of Monsta FTP for testing purposes, consistent with the stated CVE-2025-34299 lab intent.Dockerfile:17-20
Api Endpoint Disclosure
/mftp/application/api/api.phpThe README documents the vulnerable API endpoint and provides a curl command to test it, which is normal for a PoC lab environment.README.md:18-23README.md:52-55
Review boundaries

What the analysis did not establish

  • Only 2 of 5 files in the repository are included in the evidence; 3 files are omitted.
  • The evidence does not include any executable exploit or scanner code, only documentation and a Dockerfile.
  • Three files in the repository (total 5 files) were omitted from the text evidence and not reviewed; their metadata indicates they are not executable source code.
  • The downloaded Monsta FTP zip file is not included in the evidence and was not analyzed for pre-existing backdoors, but the Dockerfile retrieves it from a public archive URL with no modification.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2025-34299Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a vulnerable Monsta FTP 2.10.4 instance on Apache/PHP 7.4, intended for testing CVE-2025-34299 pre-authentication remote code execution.

README.md:1-3docker-compose.yml:1-17Dockerfile:1-28

Lab assessment

Vulnerability lab

The README explicitly states it is a test environment for CVE-2025-34299, the Dockerfile downloads a known vulnerable version of Monsta FTP, and the compose file exposes the service for testing.

README.md:1-3Dockerfile:14-17docker-compose.yml:7-8
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

monsta-ftp-vulnerable

vulnerable web applicationMonsta FTP 2.10.4

A PHP 7.4 Apache container serving Monsta FTP 2.10.4, a vulnerable version of the web-based FTP client. It exposes port 80 internally, mapped to host port 8080, and includes a healthcheck that curls the /mftp/ path.

docker-compose.yml:4-16Dockerfile:1-28
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-34299

Supported by supplied evidence

The README describes the vulnerability as pre-authentication RCE via unrestricted file upload in Monsta FTP <= 2.11.2, and the Dockerfile installs version 2.10.4, which falls within the affected range. The environment is explicitly built to demonstrate this CVE.

README.md:1-3README.md:7-11Dockerfile:14-17
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:25-28
  • The attacker must control a malicious FTP server to which the vulnerable Monsta FTP instance will connect.README.md:17-20

Evidence-described exercise path

  1. Clone the repository and start the vulnerable environment with docker-compose up -d.README.md:25-28
  2. Verify the service is running by checking for 'MonstaFTP' in the response from http://localhost:8080/mftp/.README.md:30-31
  3. Test the vulnerability using a nuclei template or manually send a crafted POST request to the downloadFile API endpoint to trigger a connection to an attacker-controlled FTP server and achieve RCE.README.md:33-50
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. It downloads a known vulnerable application from a web archive, runs it in a container, and exposes a port for testing. No hidden, destructive, or host-escaping behavior is visible. The port mapping and healthcheck are standard for a lab.

docker-compose.yml:1-17Dockerfile:1-28README.md:1-89
Review boundaries

What the analysis did not establish

  • No exploit code or nuclei template is included in the packet, so the exact exploit mechanism cannot be verified.
  • The downloaded Monsta FTP zip is from web.archive.org; its integrity is not verified beyond the URL.
  • The packet does not include the application source code, only the Dockerfile and compose file.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1