Description

The vulnerability detector identifies Java code that establishes insecure FTP connections using plaintext URLs. Using plain FTP instead of secure protocols like SFTP or FTPS can expose sensitive data to network eavesdropping and man-in-the-middle attacks since data is transmitted without encryption.

Detection Strategy

• Check for calls to openConnection() method in Java code

• Verify if the connection object is created from a URL or URI instance

• Analyze if the URL/URI string uses the insecure 'ftp://' protocol scheme

• Report a vulnerability when an insecure FTP connection is established through URL.openConnection() or URI.openConnection()

Vulnerable code example

import java.net.URL;
import java.net.URLConnection;

public void unsafeFtpConnection() {
    // Vulnerable: Plain FTP connection exposes credentials and data in cleartext
    URL url = new URL("ftp://user:password@ftp.example.com/file.txt");
    URLConnection conn = url.openConnection(); // Vulnerable: Uses insecure FTP protocol
}

✅ Secure code example

import java.net.URL;
import java.net.URLConnection;

public void safeFtpConnection() {
    // Safe: Using SFTP protocol which encrypts both credentials and data
    URL url = new URL("sftp://user:password@ftp.example.com/file.txt");
    URLConnection conn = url.openConnection(); // Safe: SFTP ensures encrypted transfer
}