Confidential Document – Improper File Exposure via FTP

Abstract

This penetration test was performed in a controlled laboratory environment using the OWASP Juice Shop application.
The objective of this challenge was to access a confidential internal document that should not be publicly available.

By identifying an exposed file download link and manually manipulating the URL, it was possible to access an openly accessible FTP directory listing. This misconfiguration allowed unrestricted browsing of internal documents and ultimately led to the discovery of a confidential file, completing the challenge.

This scenario demonstrates the risks of exposed file services, missing access controls, and improper segregation of public and internal resources.

Preparation Documentation

Identified Vulnerability / Vulnerabilities and Risk Assessment

• Identified Vulnerability: Improper file exposure via publicly accessible FTP endpoint
• Category: Security Misconfiguration / Sensitive Data Exposure
• Risk Assessment: Medium
• Potential Impact:
  • Disclosure of confidential or internal documents
  • Exposure of business-sensitive information (e.g. acquisition plans)
  • Potential intelligence gathering for further targeted attacks

Known Exploits

• No specific CVE is associated with this issue.
• This vulnerability class is widely documented in:
  • OWASP Top 10 – A05: Security Misconfiguration
  • OWASP Top 10 – A02: Cryptographic Failures (Sensitive Data Exposure)
• Common exploit pattern:
  • Directory listing enabled
  • Public access to internal file storage endpoints

Execution of the Penetration Test

• Entry Point:

  • About Us section of the application
  • Link embedded in placeholder (Lorem Ipsum) text

• Observed Endpoint:

  /ftp/legal.md
  

• Tools Used:

  • Web browser (manual inspection)
  • No automated tools required

• Testing Method:

  • Manual URL inspection and path manipulation

• Assumptions and Constraints:

  • Test performed on a local OWASP Juice Shop instance
  • No authentication required to access the FTP endpoint
  • Scope limited to file access and disclosure

Results Documentation

Accessible Information

• Publicly accessible Markdown files hosted on the FTP endpoint
• Directory listing revealed multiple internal documents
• A confidential document related to internal acquisitions was accessible

No credentials, authentication tokens, or configuration files were exposed during this challenge.

Exploitation Depth

• Full read access to the exposed FTP directory
• Ability to enumerate and access multiple internal documents
• Exploitation limited to read-only data exposure
• No write access, privilege escalation, or lateral movement observed

Discovery Process

• Manual exploration of the application content
• Identification of a downloadable Markdown file (legal.md)
• Observation of the /ftp/ path in the browser URL
• Hypothesis that directory browsing might be enabled

Exploitation Process

1. Navigated to the About Us section of the application.
2. Clicked the embedded link within the Lorem Ipsum text.
3. Opened or downloaded the file legal.md.
4. Observed the URL change to:

   /ftp/legal.md
   

5. Removed legal.md from the URL to access:

   /ftp/
   

6. The FTP directory listing became visible.
7. Browsed available files on the FTP server.
8. Located and opened the confidential document (acquisitions.md).
9. Successfully accessed the secret document.

Outcome

• A confidential internal document was successfully accessed.
• The challenge “Confidential Document” was completed.
• Demonstrated improper exposure of internal file storage.
• No further system access was obtained.

Mitigation Measures

• Disable directory listing on file servers.
• Restrict access to internal file storage using authentication and authorization.
• Separate public assets from internal or confidential documents.
• Regularly audit exposed endpoints for unintended file access.

Recommendations and Prioritization

• Priority: Medium
• Remove or protect publicly accessible FTP endpoints.
• Enforce strict access control on all file-serving services.
• Implement monitoring and logging for unauthorized file access attempts.
• Conduct periodic security configuration reviews.