MiCode FileExplorer SwiFTP Server Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the MiCode FileExplorer application, specifically within the embedded SwiFTP FTP server component. This vulnerability allows network attackers to log in without valid credentials. Exploitation involves sending arbitrary username and password combinations to the PASS command handler, which indiscriminately grants access. Once authenticated, attackers can list, read, write, and delete files exposed by the FTP server. It is important to note that the MiCode FileExplorer project is no longer supported.

Impact

Exploitation of this vulnerability allows for unauthorized access to the FTP server, enabling attackers to manipulate files by listing, reading, writing, or deleting them.