Skip to main content

Use of an insecure channel - FTP

Need​

Secure transmission of customer information

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance improvements
  • Usage of javax.servlet for building Java web applications with Servlet technology
  • Usage of Apache Commons Net FTP library for FTP file transfer operations

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class FtpServlet extends HttpServlet {

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");

        String server = "ftp.example.com";
        int port = 21;

        FTPClient ftpClient = new FTPClient();
        try {
            ftpClient.connect(server, port);
            ftpClient.login(username, password);

            // ... other operations

        } catch (IOException ex) {
            ex.printStackTrace();
        } finally {
            try {
                if (ftpClient.isConnected()) {
                    ftpClient.logout();
                    ftpClient.disconnect();
                }
            } catch (IOException ex) {
                ex.printStackTrace();
            }
        }
    }
}

The above Java Servlet code represents a scenario where a user's credentials are being transmitted over FTP, which is an insecure channel.

In the doPost method, the servlet retrieves the username and password from the HTTP request parameters. These credentials are then used to establish a connection with an FTP server and perform various operations.

The vulnerability here lies in the usage of FTP for transmitting sensitive information. FTP does not use encryption, meaning that the data is sent in plain text over the network. This makes it easy for an attacker who has access to the network to capture the data and view the user's credentials.

Furthermore, the code does not include any measures to protect against potential Man-in-the-Middle (MitM) attacks, where an attacker could intercept the communication between the user and the FTP server, and manipulate or steal the data.

This insecure transmission of data can lead to unauthorized access and potential data breaches, posing a significant security risk.

Steps​

  • Use a secure channel for transmitting sensitive information, such as HTTPS.
  • Avoid using FTP for transmitting sensitive information.
  • Consider using a more secure protocol, such as SFTP or FTPS, for file transfer.
  • Implement encryption mechanisms, such as SSL/TLS, to protect the confidentiality of data during transmission.
  • Ensure that the FTP server is properly configured to support secure connections.
  • Implement strong authentication mechanisms, such as multi-factor authentication, to protect against unauthorized access to the FTP server.
  • Regularly update and patch the FTP server software to address any security vulnerabilities.
  • Implement secure coding practices, such as input validation and output encoding, to prevent other types of security vulnerabilities.

Compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import org.apache.commons.net.ftp.FTPSClient;

public class SecureFtpServlet extends HttpServlet {

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");

        String server = "ftp.example.com";
        int port = 21;

        FTPSClient ftpsClient = new FTPSClient();
        try {
            ftpsClient.connect(server, port);
            ftpsClient.login(username, password);
            ftpsClient.execPBSZ(0);
            ftpsClient.execPROT("P");

            // ... other operations

        } catch (IOException ex) {
            ex.printStackTrace();
        } finally {
            try {
                if (ftpsClient.isConnected()) {
                    ftpsClient.logout();
                    ftpsClient.disconnect();
                }
            } catch (IOException ex) {
                ex.printStackTrace();
            }
        }
    }
}

The original code was vulnerable because it was using FTP (File Transfer Protocol) to transmit sensitive data. FTP does not encrypt data, which means that anyone who can intercept the data can read it in plain text.

The fixed code uses FTPS (FTP Secure), which is an extension of FTP that adds support for the Transport Layer Security (TLS) and the Secure Sockets Layer (SSL) cryptographic protocols. This means that the data is encrypted before it is transmitted, and can only be decrypted by the intended recipient.

The FTPSClient class is used instead of the FTPClient class. After the client connects to the server and logs in, it executes the execPBSZ(0) and execPROT("P") commands. The execPBSZ(0) command sets the protection buffer size to 0, and the execPROT("P") command sets the data channel protection level to private. This means that all data transmitted over the data channel is encrypted.

The server must be configured to support FTPS. If it is not, the connection will fail. The server should also be regularly updated and patched to address any security vulnerabilities.

In addition to using FTPS, other security measures should be implemented, such as strong authentication mechanisms and secure coding practices.

References​

Last updated on