Title: Beehive/SendFile.NET - Secure File Transfer Appliance Hardcoded Credentials Vendor: Beehive Software Vendor URL: http://www.thebeehive.com/ Affected File: http://<host>/sfcommon/SendFile.jar Vendor Contact Date: 7/26/2007 Vendor Response: None Workaround: The simplest way to protect against this attack is to block access to unnecessary services (e.g FTP) from the internet. Description: Within the outboxWriteUnsent() function of the FTPThread.class file of SendFile.jar the following lines reveal a hardcoded username and password which can be used to login to the FTP Server. Most servers disallow direct communication to the appliance from the internet however threats from the internal network still exist. SendFile.jar: ------------<snip>------------ URL url1 = new URL(url.getProtocol() + "://" + url.getHost() + "/s.ftp?command=putfile&user=sfoutbox&pass=sfoutbox&dir=" + mAcctID + "/" + FTPStream.escapePathName(mUser) + "&createdir=1&file=" + mOutboxTime + ".unsent.html"); ------------</snip>------------ And ------------<snip>------------ ftpstream = new FTPStream(mApplet.getDocumentBase().getHost(), "sfoutbox", "sfoutbox", true, false, mProgressWindow, false, mProxyIP, mProxyPort, mProxyUser, mProxyPass); ------------</snip>------------ Credit: Brad Antoniewicz Email: Brad.Antoniewicz at foundstone.com