CWE-220, Storage of File With Sensitive Data Under FTP Root, is the FTP counterpart of the web root problem. The product stores sensitive data under the FTP server root with insufficient access control, which may make it reachable by untrusted parties.
Anything that shares files over FTP, including legacy exchange points and partner drop folders, can have it.
How it happens
Files accumulate in the shared directory: exports, reports, backups, config. Nobody reviews what is in the root, and anonymous or low-privilege accounts can list and download it. MITRE's record lists no observed CVE examples for this variant.
What an attacker gains
MITRE lists confidentiality: reading application data. The attacker needs only to connect and browse.
How to find it
MITRE lists no detection methods. Connect to your FTP service as an anonymous or low-privilege user and list the tree. Compare what you can read against what you meant to share.
How to fix it
MITRE's mitigations:
- Avoid storing information under the FTP root directory.
- Set access control permissions to prevent reading or writing of sensitive files inside or outside the FTP directory.
If you can retire FTP for a service that supports something with stronger authentication, that removes the exposure altogether.
Quick check
Who can see a file under the FTP root?
Anyone the server lets read that directory, which for anonymous access means anyone who can connect.
