Storage of File With Sensitive Data Under FTP Root

Description

Storage of File With Sensitive Data Under FTP Root is a vulnerability that occurs when a product stores sensitive data in files located under the FTP server root directory without implementing sufficient access controls. Similar to web root exposure, the FTP root is the base directory from which an FTP server serves files to connecting clients. Files placed in this directory or its subdirectories may be accessible to FTP users, including anonymous users if anonymous FTP access is enabled. This vulnerability is particularly concerning because FTP servers historically require password files and configuration data to be located under the FTP root due to chroot jail implementations, creating inherent conflicts between security isolation and data protection requirements.

Risk

Storing sensitive data under the FTP root creates significant security risks, especially in environments supporting anonymous FTP access. Database files, configuration files with credentials, backup archives, and log files become accessible to any user who can establish an FTP connection. Anonymous FTP, still common for software distribution and public file sharing, allows completely unauthenticated access to exposed sensitive files. Even in authenticated FTP scenarios, users may have broader file access than intended if directory permissions are misconfigured. The risk is compounded by the lack of encryption in standard FTP, meaning sensitive files downloaded over FTP can be intercepted in transit. Automated scanning tools routinely probe FTP servers for sensitive files, and exposed credentials are quickly harvested for further attacks.

Solution

Store all sensitive data outside the FTP root directory in locations that cannot be accessed via FTP connections. Configure the FTP server to restrict directory traversal and limit access to specific subdirectories. If sensitive files must be under the FTP root due to chroot requirements, implement strict file permissions limiting access to the FTP daemon user only. Disable anonymous FTP access unless absolutely required, and if enabled, ensure anonymous users cannot access directories containing sensitive data. Use SFTP or FTPS instead of plain FTP to protect data in transit. Regularly audit FTP-accessible directories for sensitive files. Consider containerized FTP deployments that isolate the file system from sensitive application data.

Common Consequences

Impact	Details
Confidentiality	Scope: Confidentiality Attackers with FTP access can read sensitive application data including configuration files, database contents, credentials, and personal information stored under the FTP root directory.

Example Code

Vulnerable Configuration (Directory Structure)

The following configuration demonstrates a vulnerable FTP server setup:

/var/ftp/                           # FTP root (vsftpd chroot)
├── pub/                            # Public downloads - intended
│   ├── software/
│   └── documentation/
├── incoming/                       # Upload directory - intended
├── config/                         # VULNERABLE: Sensitive config
│   ├── database.conf               # DB credentials exposed
│   └── app.ini                     # API keys exposed
├── backups/                        # VULNERABLE: Backup files
│   ├── db_dump_2024.sql           # Complete database dump
│   └── users.tar.gz               # User data backup
├── .passwd                         # VULNERABLE: FTP password file
├── .htpasswd                       # VULNERABLE: HTTP auth file
└── logs/                           # VULNERABLE: Log files
    └── access.log                  # May contain sensitive data

# /etc/vsftpd.conf - Insecure configuration
anonymous_enable=YES
anon_root=/var/ftp
local_enable=YES
write_enable=YES
# No directory restrictions configured
# All files under /var/ftp accessible to anonymous users

# Attacker exploitation
$ ftp [email protected]
ftp> cd config
ftp> get database.conf
ftp> cd ../backups
ftp> get db_dump_2024.sql
ftp> cd ..
ftp> get .passwd

Fixed Configuration (Directory Structure)

/var/                               # System root
├── ftp/                            # FTP root (public only)
│   ├── pub/                        # Public downloads
│   │   ├── software/
│   │   └── documentation/
│   └── incoming/                   # Uploads (write-only)
│
├── app/                            # SAFE: Outside FTP root
│   ├── config/
│   │   ├── database.conf
│   │   └── app.ini
│   └── data/
│       └── database.db
│
├── backups/                        # SAFE: Outside FTP root
│   └── db_dump_2024.sql
│
└── log/                            # SAFE: Outside FTP root
    └── app/
        └── access.log

# /etc/vsftpd.conf - Secure configuration

# Disable anonymous access unless required
anonymous_enable=NO

# If anonymous needed, restrict severely
# anonymous_enable=YES
# anon_root=/var/ftp/pub
# anon_upload_enable=NO
# anon_mkdir_write_enable=NO

# Chroot authenticated users
chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

# Local user settings
local_enable=YES
local_root=/var/ftp

# Restrict to specific directory
user_sub_token=$USER
local_root=/var/ftp/users/$USER

# Prevent directory traversal
allow_writeable_chroot=NO
chmod_enable=NO

# Use FTPS for encryption
ssl_enable=YES
force_local_data_ssl=YES
force_local_logins_ssl=YES

# Logging for audit
xferlog_enable=YES
xferlog_std_format=NO
log_ftp_protocol=YES

# Set proper permissions on FTP directories
chmod 755 /var/ftp/pub
chmod 1733 /var/ftp/incoming  # Sticky bit + write-only for others

# Ensure sensitive dirs not under FTP root
chmod 700 /var/app/config
chown app:app /var/app/config

# If password file must be in FTP root (chroot requirement)
chmod 600 /var/ftp/.passwd
chown root:root /var/ftp/.passwd

# Application code: Store files outside FTP root
import os

class SecureFileStorage:
    # Never store under FTP root
    FTP_ROOT = '/var/ftp'
    APP_DATA = '/var/app/data'
    BACKUP_DIR = '/var/backups'

    def store_config(self, config_data):
        """Store configuration outside FTP root"""
        config_path = os.path.join(self.APP_DATA, 'config.json')
        # Verify path is NOT under FTP root
        assert not config_path.startswith(self.FTP_ROOT), \
            "Config must not be stored under FTP root"
        with open(config_path, 'w') as f:
            f.write(config_data)
        os.chmod(config_path, 0o600)

    def create_backup(self, backup_data):
        """Create backup outside FTP root"""
        backup_path = os.path.join(self.BACKUP_DIR, 'backup.tar.gz')
        assert not backup_path.startswith(self.FTP_ROOT), \
            "Backups must not be stored under FTP root"
        # Create backup...

The fix stores all sensitive data outside the FTP root, configures strict access controls, uses chroot isolation, and optionally enables FTPS encryption.

Exploited in the Wild

Anonymous FTP Credential Exposure (Multiple Organizations, 1990s-2000s)

During the early internet era, numerous organizations exposed password files, database dumps, and configuration files through misconfigured anonymous FTP servers. Attackers used simple FTP clients to enumerate directories and download sensitive files. The Chaos Computer Club famously demonstrated downloading classified documents from government FTP servers that had inadvertently exposed sensitive directories.

https://resources.infosecinstitute.com/topics/network-security/ftp-security/

FTP Server Misconfigurations in Healthcare (Healthcare Organizations, 2018)

Security researchers discovered multiple healthcare organizations exposing patient data through anonymous FTP servers. Sensitive files including medical records, insurance information, and patient directories were accessible without authentication. These incidents led to HIPAA violation investigations and highlighted the risks of legacy FTP infrastructure.

https://www.hipaajournal.com/category/ftp-hipaa/

ProFTPD Backup Exposure (Various Organizations, Ongoing)

Organizations using ProFTPD have inadvertently exposed backup files when administrators stored database dumps in FTP-accessible directories for easier transfer between systems. These backups often contained complete databases with credentials and user data, accessible to anyone with FTP access.

https://www.proftpd.org/docs/howto/Chroot.html

Tools to Test/Exploit

Nmap FTP Scripts — Nmap scripts for detecting anonymous FTP access and enumerating accessible files.
Metasploit FTP Modules — Scanning modules for identifying FTP misconfigurations and accessible sensitive files.
FileZilla — FTP client useful for manual exploration of FTP servers during security assessments.

CVE Examples

CVE-2001-0934 — FTP server exposed sensitive files due to improper directory restrictions in chroot configuration.
CVE-2005-0503 — Application stored database credentials in FTP-accessible configuration file.
CVE-2010-2632 — FTP server allowed directory traversal enabling access to files outside intended directory.

References

MITRE Corporation. "CWE-220: Storage of File With Sensitive Data Under FTP Root." Common Weakness Enumeration. https://cwe.mitre.org/data/definitions/220.html
vsftpd Documentation. "Chroot and Security." https://security.appspot.com/vsftpd.html
NIST. "Guidelines on Active Content and Mobile Code." Special Publication 800-28. https://csrc.nist.gov/publications/detail/sp/800-28/final
OWASP Foundation. "File System Security." https://owasp.org/www-community/attacks/Path_Traversal