rxerium/CVE-2025-34299

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects Monsta FTP instances vulnerable to CVE-2025-34299 by checking the HTTP response for a title tag, extracting the version, and comparing it to < 2.11. It does not upload files or execute code.

Backdoor review

No backdoor observed in reviewed code

The artifact contains a Nuclei detection template (CVE-2025-34299.yaml) and a README.md. The template performs a GET request to identify Monsta FTP instances and compares the extracted version against 2.11. The README provides usage instructions and references. No backdoor, deceptive payload, or concealed harmful behavior is observed in the supplied text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAML
Target softwareMonsta FTP
Attack typesdetection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that performs version detection via HTTP response matching. It does not contain any code to upload files, execute commands, or otherwise exploit the vulnerability. The README explicitly describes it as a 'detection template' and 'vulnerability detection script'.

CVE-2025-34299.yaml:1-36README.md:5-7README.md:43

Requirements

  • Target must be running Monsta FTP and accessible via HTTP.CVE-2025-34299.yaml:12-15

Observed behavior

  • Sends an HTTP GET request to the target base URL.CVE-2025-34299.yaml:13-15
  • Extracts the Monsta FTP version from the HTML title tag using a regex.CVE-2025-34299.yaml:17-22
  • Matches if the response contains '<title>Monsta FTP', returns status 200, and the extracted version is less than 2.11.CVE-2025-34299.yaml:24-36
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template
CVE-2025-34299.yamlDetection template for CVE-2025-34299; performs version detection only.CVE-2025-34299.yaml:1-36
Contact Method
Signal link: https://signal.me/#eu/0Qd68U1ivXNdWCF4hf70UYFo7tB0w-GQqFpYcyV6-yr4exn2SclB6bFeP7wTAxQwAuthor contact information in README; not a backdoor indicator.README.md:43
Review boundaries

What the analysis did not establish

  • One file (likely .gitkeep or similar) is omitted from the text evidence; its metadata indicates it is not a text file and is not analyzed.
  • The evidence does not include the actual execution of the template; classification is based solely on static analysis of the provided YAML and README.
  • One file (metadata only, not analyzed) was omitted from the text evidence; its content is unknown.
  • Binary content was not inspected; the analysis is limited to the supplied readable text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1