Skip to main content

FTP Credentials

FTP (File Transfer Protocol) credentials are used to authenticate access to FTP servers, which are commonly used for transferring files over the internet. These credentials typically consist of a username and password, granting access to upload, download, or manage files on the server. Exposure of FTP credentials is a significant security concern as it can lead to unauthorized access to sensitive files, data breaches, and potential manipulation of server contents.

How Does It Look​

FTP credentials can appear in various contexts, such as:

  • Environment variables:

    export FTP_USER="ftp_user"
    export FTP_PASS="ftp_password"

  • Configuration files (JSON, YAML, .env):

    {
      "ftp": {
        "username": "ftp_user",
        "password": "ftp_password"
      }
    }
    ftp:
      username: ftp_user
      password: ftp_password
    FTP_USER=ftp_user
    FTP_PASS=ftp_password

  • Code snippets:

    import ftplib

    ftp = ftplib.FTP("ftp.example.com")
    ftp.login(user="ftp_user", passwd="ftp_password")

  • Connection strings:

    ftp://ftp_user:ftp_password@ftp.example.com

Severity​

  • 🔴 Critical

FTP credentials are considered critical because they provide direct access to the server's file system. An attacker with these credentials can potentially access, modify, or delete sensitive files, leading to data breaches and operational disruptions. The blast radius can be extensive, affecting all data and services dependent on the compromised server.

What Can an Attacker Do?​

With immediate access to the FTP server, an attacker can perform several malicious actions:

  • Download sensitive files (if the credential has read permissions), potentially leading to data breaches.
  • Upload malicious files (if write access is enabled), which could be used to distribute malware or conduct further attacks.
  • Delete or modify existing files (if the credential has write permissions), disrupting operations and causing data loss.
  • Access server configurations (if not restricted by permissions), potentially allowing further exploitation or lateral movement.

An attacker could also use the compromised server as a pivot point to escalate privileges or move laterally within the network, increasing the potential damage.

Real-World Impact​

The exposure of FTP credentials poses significant business risks, including:

  • Data Exposure: Sensitive files and data stored on the server (if the credential has read access to sensitive data).
  • Financial Loss: Costs associated with data breaches, remediation efforts, and potential fines (if billing/resource creation is permitted).
  • Operational Disruption: Service outages or data loss (if the attacker has delete/modify permissions).
  • Reputational Damage: Loss of customer trust and brand integrity.

In worst-case scenarios, the attacker could use the server to launch further attacks, leading to cascading effects across the organization.

Prerequisites for Exploitation​

To exploit exposed FTP credentials, an attacker needs:

  • Network access to the FTP server.
  • Server endpoint information (e.g., server address, port).
  • No IP restrictions or allowlists that would prevent unauthorized access.

How to Verify If It's Active​

To verify if the FTP credentials are active, use the following command:

ftp -inv [HOST] <<EOF
user [FTP_USER] [FTP_PASS]
bye
EOF

Valid credential response:

  • Successful login message, such as "230 Login successful."

Invalid/expired credential response:

  • Error message, such as "530 Login incorrect."

Detection Patterns​

Common Variable Names:

  • FTP_USER
  • FTP_PASS
  • FTP_USERNAME
  • FTP_PASSWORD
  • FTP_CREDENTIALS
  • FTP_LOGIN

File Locations:

  • .env
  • config.json
  • settings.yaml
  • ftp_config.ini
  • ftp_credentials.txt

Regex Pattern:

(?i)(ftp_user|ftp_pass|ftp_username|ftp_password)\s*=\s*['"]?[a-zA-Z0-9_]+['"]?

Remediation Steps​

  1. Revoke immediately - Access the FTP server's user management interface and delete the compromised user account.
  2. Audit access logs - Review FTP server logs for unauthorized access attempts or file transfers during the exposure window.
  3. Assess blast radius - Identify all systems, applications, and environments that used the exposed credential.
  4. Rotate credential - Create a new FTP user with least-privilege permissions and update all dependent systems.
  5. Update dependent systems - Deploy the new credential to all applications and update CI/CD pipelines securely.
  6. Harden access controls - Enable IP allowlisting on the FTP server and require secure connections (e.g., FTPS).
  7. Implement secrets management - Migrate credentials to a secrets manager (HashiCorp Vault, AWS Secrets Manager) to prevent hardcoding.
  8. Add detection controls - Set up pre-commit hooks and repository scanning to catch credential leaks before they reach production.

Credential exposures often go undetected for extended periods, increasing the window for exploitation. As a long-term strategy, plan to establish an internal process or engage an external vendor for continuous external exposure monitoring. This helps identify leaked secrets across public repositories, paste sites, dark web forums, and other external sources before attackers can leverage them. Proactive detection and rapid response are essential to minimizing the impact of credential leaks.

References​