Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded Credentials
Title: Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded
Credentials
Vendor: Beehive Software
Vendor URL: http://www.thebeehive.com/
Affected File: http://<host>/sfcommon/SendFile.jar
Vendor Contact Date: 7/26/2007
Vendor Response: None
Workaround:
The simplest way to protect against this attack is to block access to
unnecessary services (e.g FTP) from the internet.
Description:
Within the outboxWriteUnsent() function of the FTPThread.class file of
SendFile.jar the following lines reveal a hardcoded username and password which
can be used to login to the FTP Server. Most servers disallow direct
communication to the appliance from the internet however threats from the
internal network still exist.
SendFile.jar:
------------<snip>------------
URL url1 = new URL(url.getProtocol() + "://" + url.getHost() +
"/s.ftp?command=putfile&user=sfoutbox&pass=sfoutbox&dir=" + mAcctID +
"/" + FTPStream.escapePathName(mUser) + "&createdir=1&file=" +
mOutboxTime + ".unsent.html");
------------</snip>------------
And
------------<snip>------------
ftpstream = new FTPStream(mApplet.getDocumentBase().getHost(),
"sfoutbox", "sfoutbox", true, false, mProgressWindow, false, mProxyIP,
mProxyPort, mProxyUser, mProxyPass);
------------</snip>------------
Credit:
Brad Antoniewicz
Email: Brad.Antoniewicz at foundstone.com