logo

Database

Java Unencrypted Ftp Connection

Description

Detects the usage of insecure FTP connections in Java applications that don't use encryption. Using unencrypted FTP can expose sensitive data to network sniffing since credentials and data are transmitted in plaintext, making it vulnerable to man-in-the-middle attacks.

Weakness:

148 - Use of an insecure channel - FTP

Category: Information Collection

Detection Strategy

    • Identifies FTP client object instantiations in Java code

    • Looks for calls to the 'connect()' method on FTP client objects

    • Reports a vulnerability when an unencrypted FTP client connection is established without using FTPS or SFTP alternatives

Vulnerable code example

import org.apache.commons.net.ftp.FTPClient;

public void insecureFtpConnection() {
    FTPClient ftpClient = new FTPClient();
    // Vulnerable: Uses plain FTP instead of FTPS/SFTP, exposing data to MitM attacks
    ftpClient.connect("ftp.example.com", 21);
}

✅ Secure code example

import org.apache.commons.net.ftp.FTPSClient;

public void secureFtpConnection() {
    FTPSClient ftpsClient = new FTPSClient(true); // Use explicit FTPS with SSL/TLS
    ftpsClient.connect("ftp.example.com", 990); // Port 990 is standard for FTPS
    ftpsClient.enterLocalPassiveMode(); // Safer than active mode for firewalls
}