A FTP-related module is being imported. FTP is considered insecure. Use SSH/SFTP/SCP or some other encrypted protocol. Consider the following points when using Telnet protocol:

• FTP is a plain-text protocol, anyone watching your ftp packets on the wire will see your username, password, and everything you do on the remote system. Data sent via FTP is vulnerable to sniffing, spoofing, and brute force attacks, among other basic attack methods.
• There are no authentication policies used in FTP causing huge security threat. Communication is carried out between the two desired hosts can be intercepted in the middle.

There are several common approaches to addressing these challenges and securing FTP usage. FTPS is an extension of FTP that can encrypt connections at the client’s request. Transport Layer Security (TLS), Secure Socket Layer (SSL), and SSH File Transfer Protocol (also known as Secure File Transfer Protocol or SFTP) are often used as more secure alternatives to FTP because they use encrypted connections.

pysftp is an easy to use sftp module that utilizes paramiko and pycrypto. It provides a simple interface to sftp. It is recommended to use pysftp over ftblib.

Bad practice

import ftplib

url = "ftp://[email protected]"
connection = ftplib.FTP(url) # Sensitive, Using FTP protocol

Recommended

import pysftp

url = "ftp://[email protected]"
connection = pysftp.Connection(host=url, username=username, password=password)

References:

• ftplib module
• ftplib security problems
• pysftp module
• OWASP Top 10 2021 Category A06 - Vulnerable and Outdated Components
• SANS Top 25
• CWE-200