SFTP credentials exposure

By
Anandhu Krishnan
Published on
20 Dec 2021
Vulnerability

Description

On this web server, a file containing SFTP/FTP connection credentials was discovered.

Some SFTP/FTP clients save SFTP/FTP connection information in text files, such as hostname, username, and password. Sublime SFTP, for example, creates a file called sftp-config.json, while FileZilla saves the information in a file called recentservers.xml.

Mitigation measures

Restrict access to this file or remove it from the webserver.


Written by
Anandhu Krishnan
Anandhu Krishnan
Lead Engineer
Experience the Beagle Security platform
Unlock one full penetration test and all Advanced plan features free for 10 days