Anonymous FTP access on internet-facing file servers
The short version: An internet-facing FTP service that permits anonymous authentication lets anyone log in with no password and browse what it serves — and, if it's writable, drop files of their own.
What you need to know
This isn't a CVE — it's a misconfiguration. Anonymous FTP is a legacy convenience that lets people retrieve files without an account. That's fine for a genuinely public file drop and dangerous for almost everything else, because "no account required" means no authentication and no accountability — anyone on the internet who finds the service can connect.
- How they find it — internet-wide scanning flags open FTP services, and the login banner reveals when anonymous access is allowed.
- How they use it — they log in anonymously to enumerate and download whatever is reachable; where the directory is writable, they upload content.
- What it leads to — an unauthenticated data leak if the anonymous root exposes sensitive files, or a foothold if it's writable (staging malware, dropping a web shell if the directory is also web-served). Underneath it all, classic FTP is cleartext, so even intended use exposes file contents and credentials in transit.
How serious we see it
High — by default, and we'll say plainly when it's worse. An anonymous FTP serving a small, deliberately public, read-only directory is a low-grade exposure — untidy, not an emergency. The severity climbs fast with capability: if the anonymous account can reach sensitive files it's an unauthenticated data-disclosure issue, and if it can upload, it's a foothold we'd treat as High. Like most misconfigurations, it's fully in your hands to fix and quick to verify — no vendor, no patch cycle.
What to do
- Disable anonymous authentication on internet-facing FTP wherever you can — this closes the exposure outright.
- If anonymous access is genuinely required, fence it hard — a dedicated directory with only the files that must be public, and audit what's actually reachable.
- Never allow anonymous uploads — keep the anonymous root strictly read-only.
- Move off cleartext FTP — prefer FTPS or SFTP so file contents and credentials aren't exposed in transit.
- Confirm your exposure first — verify whether any FTP service is internet-facing and accepts anonymous logins today.
How BreachRisk sees it
BreachRisk finds this the way an attacker would. It discovers exposed FTP services in your external footprint, reads the service's responses for anonymous-login indicators, and then — rather than flagging a maybe — safely attempts an anonymous login to confirm it actually succeeds, as a benign check rather than a data grab. That's the difference between "this banner suggests anonymous FTP" and "we logged in anonymously; here's the confirmed exposure." A stray anonymous FTP — the kind that appears when someone stands up a quick file share and forgets it — surfaces as a verified finding before it becomes someone's foothold.