bugtraq - Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded Credentials

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080229012952.25995.qmail@securityfocus.com>
Date: 29 Feb 2008 01:29:52 -0000
From: brad.antoniewicz@...ndstone.com
To: bugtraq@...urityfocus.com
Subject: Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded
 Credentials

Title: Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded Credentials

Vendor: Beehive Software
Vendor URL: http://www.thebeehive.com/

Affected File: http://<host>/sfcommon/SendFile.jar

Vendor Contact Date: 7/26/2007

Vendor Response: None

Workaround:
The simplest way to protect against this attack is to block access to unnecessary services (e.g FTP) from the internet. 

Description:
Within the outboxWriteUnsent() function of the FTPThread.class file of SendFile.jar the following lines reveal a hardcoded username and password which can be used to login to the FTP Server. Most servers disallow direct communication to the appliance from the internet however threats from the internal network still exist. 

SendFile.jar:

------------<snip>------------
URL url1 = new URL(url.getProtocol() + "://" + url.getHost() +
"/s.ftp?command=putfile&user=sfoutbox&pass=sfoutbox&dir=" + mAcctID +
"/" + FTPStream.escapePathName(mUser) + "&createdir=1&file=" +
mOutboxTime + ".unsent.html");
------------</snip>------------

And 

------------<snip>------------
ftpstream = new FTPStream(mApplet.getDocumentBase().getHost(),
"sfoutbox", "sfoutbox", true, false, mProgressWindow, false, mProxyIP,
mProxyPort, mProxyUser, mProxyPass);
------------</snip>------------

Credit: 
Brad Antoniewicz
Email: Brad.Antoniewicz at foundstone.com