1

I'm developing a web application which stores sensitive information, which the user can access after a check that I built. This function then returns a download url to the user which leads to the FTP Server.

My concern is that it might be vulnerable to exploitation, people could alter certain url's to download files from the FTP Server. For example changing:

/App_Data/Company1/Financials_2015.pdf

To:

/App_Data/Company2/Financials_2015.pdf

Is this possible to be exploited and if so, is there a better way to make sure this can't be abused?

  • 7
    Why not just serve the PDFs from your web server where you have authorization properly set up? – Philip Kendall May 1 '17 at 15:11
  • If /App_Data/Company2/ and /App_Data/Company2/Financials_2015.pdf are universally accessible (e.g., 0777 access mode in unix), yes, they can. Why would you do that? And why are you using an ftp server? – David Hammen May 1 '17 at 15:28
  • 1
    Is it possible to set up per-folder permissions on the FTP server? If so, for a given API user (Company 1), only give them permissions to access the Company1 folder. If every company is using the same FTP credentials ... then you can't lock down 1 company from looking into the folders of another company. – Graham May 1 '17 at 15:32
  • 4
    The fact that you're asking this question at all means that you are building a device that manipulates sensitive data without a threat model. Do a formal threat model. – Eric Lippert May 1 '17 at 16:30
3

Securing an FTP server requires having the appropriate users/groups set up on the FTP server and correctly assigning ownership to the files in the FTP server. That means that the FTP server in this case would have:

  • Group "Company1"
  • Group "Company2"
  • Users that are assigned to one group or the other
  • Files who's group owner are "Company1"
  • Files who's group owner are "Company2"

Only users who belong to the correct group can retrieve the files. Also, as @JimmyJames mentioned you should be using SFTP or FTPS.

A better option would be to use your HTTP server to control access. You can provide WebDAV access if you want to get fancy. Windows 7 allows a user to mount a WebDAV area as a remote drive.

Most users are perfectly content just clicking on a link to have a report download to their computer, and since you already have the infrastructure built, this solution is going to give you the most manageable solution.

  • 1
    Not a bad answer but I think when people 'get fancy' is when things start going wrong. Specifically for this, the mistake a lot of people make is that they use some sort of 'do it all for you solution' for exposing a directory through HTTP. They don't realize that it often means ../../../... will be supported implicitly. Then they run the app as root and give the entire internet access to the host's shadow file. – JimmyJames May 1 '17 at 20:04
  • WebDAV is just a spec, formalizing REST endpoints for what would look like a file system. Hopefully someone aware enough to ask how to secure at least this much of their app would also be aware enough to never run their app as a super-user (root on Unix or Administrator on Windows). Particularly since you have to go out of your way these days to set app servers up this way. – Berin Loritsch May 1 '17 at 20:31
2

In a nutshell the answer is that it depends. This kind of vulnerability is very common and it comes down to either mis-configuration and/or bugs in the FTP software. Read the manual and check the CVE list for your platform.

For sure you need to be using SFTP or FTPS. Note that the former uses SSH and therefore you need actual users to exist on the host. These users can exit into a plain SSH session so you need to be precise about what permissions you give them on the host.

There are a lot of people who continue to push FTP as a solution and claim it is fine. I tend to disagree and think that HTTPS can do everything that FTP can do (and more) and it is easier to manage. As Phillip Kendall points out, you already have to deal with the web site and the risks associated with it so you are simply increasing the attack surface by introducing FTP in to the mix. Sometimes you will have to deal with third-parties that 'require' FTP due to ineptitude. That's really the only legitimate reason to use it, IMO.

2

If by location on a FTP server you mean only the location but the files are still being downloaded using a HTTP(S) connection then what you are after is another layer of security when executing your script.

Instead of serving a file directly, when someone requests a file from your server you silently redirect them to a script which checks permissions to the file (this is very likely to be a database lookup) and if the condition passes you start streaming the file from your server. If it does not you either return 403 Forbidden or 404 Not Found, if you do not want to let unauthorized users know that other files they are trying to access even exist on the server.

If you are speaking directly of a FTP connection then your solution is directory/file permission.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.