AOH :: HP Unsorted B :: BX2165.HTM

Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded Credentials



Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded Credentials
Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded Credentials



Title: Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded Credentials

Vendor: Beehive Software
Vendor URL: http://www.thebeehive.com/

Affected File: http:///sfcommon/SendFile.jar

Vendor Contact Date: 7/26/2007

Vendor Response: None

Workaround:
The simplest way to protect against this attack is to block access to unnecessary services (e.g FTP) from the internet.

Description:
Within the outboxWriteUnsent() function of the FTPThread.class file of SendFile.jar the following lines reveal a hardcoded username and password which can be used to login to the FTP Server. Most servers disallow direct communication to the appliance from the internet however threats from the internal network still exist.

SendFile.jar:

------------------------
URL url1 = new URL(url.getProtocol() + "://" + url.getHost() +
"/s.ftp?command=putfile&user=sfoutbox&pass=sfoutbox&dir=" + mAcctID +
"/" + FTPStream.escapePathName(mUser) + "&createdir=1&file=" +
mOutboxTime + ".unsent.html");
------------------------

And

------------------------
ftpstream = new FTPStream(mApplet.getDocumentBase().getHost(),
"sfoutbox", "sfoutbox", true, false, mProgressWindow, false, mProxyIP,
mProxyPort, mProxyUser, mProxyPass);
------------------------

Credit:
Brad Antoniewicz
Email: Brad.Antoniewicz at foundstone.com


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.