CVE-2015-3306: ProFTPD mod_copy Improper Access Control Enables Arbitrary File Read/Write

Background

ProFTPD is a widely deployed, open-source FTP server for Unix-like systems, used by hosting providers, enterprises, and embedded appliances to provide file transfer services. It has shipped as the default or optional FTP daemon in many Linux distributions and web-hosting control panels for over two decades, meaning even long-patched vulnerabilities in it can resurface on systems that were provisioned once and never upgraded.

CVE-2015-3306 affects ProFTPD’s mod_copy module, which implements the non-standard SITE CPFR (copy-from) and SITE CPTO (copy-to) FTP commands. These commands let an FTP client instruct the server to copy a file from one server-side path to another without re-uploading the file’s contents — a convenience feature intended to speed up operations like duplicating files within an account’s own directory tree.

Technical Mechanism

CVE-2015-3306 is classified under CWE-284, Improper Access Control. The mod_copy module’s SITE CPFR and SITE CPTO commands accept arbitrary server-side file paths as arguments but, in vulnerable configurations, fail to properly enforce that the requesting session is authorized to access those paths — notably, this flaw is exploitable even by anonymous/unauthenticated sessions where anonymous FTP access is enabled, because the commands do not re-check the same path restrictions that govern normal upload/download operations.

The attack flow is straightforward:

# Connect to the FTP server (anonymous access sufficient in vulnerable configs)
ftp> USER anonymous
ftp> PASS [email protected]

# Instruct the server to copy an arbitrary readable file to a web-accessible path
ftp> SITE CPFR /etc/passwd
ftp> SITE CPTO /var/www/html/passwd.txt

# Or, more dangerously, plant a web shell by copying attacker-controlled
# content already on the server (e.g. an uploaded file) into the webroot:
ftp> SITE CPFR /var/ftp/incoming/shell.php.txt
ftp> SITE CPTO /var/www/html/shell.php

Because SITE CPFR/SITE CPTO operate as raw filesystem copy operations rather than FTP-protocol-governed uploads/downloads, they bypass the path and permission checks that would normally confine a session to its designated directory. This allows reading sensitive files outside the intended FTP root (such as /etc/passwd or application configuration files containing credentials) and, more severely, writing files to arbitrary locations the server process can access — including web-accessible directories, enabling remote code execution via a planted web shell if a file with attacker-controlled content can first be placed anywhere on the filesystem (for example, via an anonymous upload directory).

Real-World Exploitation Evidence

CVE-2015-3306 was added to CISA’s KEV catalog on 2026-10-08, confirming that CISA has evidence of active exploitation in the wild as of that date — over a decade after the vulnerability was originally disclosed in 2015. This is a notable example of a long-known flaw remaining a live exploitation target because unpatched, end-of-life, or forgotten ProFTPD instances remain exposed on the internet.

CISA’s data lists knownRansomwareCampaignUse as “Unknown” for this entry — CISA has not confirmed use of this specific vulnerability in ransomware operations at this time. No specific threat actor or named campaign is attributed to current exploitation activity in the available data; its KEV listing confirms active exploitation in the wild, but public attribution detail beyond that is not currently available.

Impact Assessment

The maximum CVSS score of 10.0 reflects unauthenticated, network-reachable exploitation with complete impact to confidentiality, integrity, and availability:

• Arbitrary file read exposes any file readable by the FTP service account, including system configuration, credentials, and application secrets.
• Arbitrary file write enables planting malicious files in any writable, server-accessible location — most critically, web-accessible directories, which converts this file-access flaw directly into remote code execution via web shell upload.
• Anonymous exploitability in common configurations means no credential theft or social engineering is required — any network-reachable vulnerable server is exposed.
• Legacy/embedded exposure: Because ProFTPD ships in many hosting control panels, NAS devices, and embedded appliances that receive infrequent updates, this vulnerability disproportionately threatens small business hosting environments, shared hosting providers, and IoT/embedded Linux devices that bundled an old ProFTPD build and were never patched.

Affected Versions

The KEV data provided does not include an explicit version range. Per the original 2015 disclosure and ProFTPD’s own advisories, versions of ProFTPD with mod_copy enabled prior to the fixed releases are vulnerable. Organizations should consult the ProFTPD project and their Linux distribution’s security advisories for the definitive affected/fixed version list for their specific build.

Remediation Steps

CISA’s required action is to apply mitigations per vendor instructions, consistent with BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable.

1. Upgrade ProFTPD to a version with the mod_copy access-control fix applied. Check your distribution’s package repository for the current patched build.

   # Debian/Ubuntu example
   apt-get update && apt-get install --only-upgrade proftpd-basic

2. If upgrading is not immediately possible, disable mod_copy in the ProFTPD configuration:

   # proftpd.conf
   <IfModule mod_copy.c>
     # Remove or comment out mod_copy from your build, or explicitly deny:
     DenyAll
   </IfModule>

3. Disable anonymous FTP access unless strictly required, which removes the most trivial exploitation path.
4. Restrict FTP service exposure to trusted networks via firewall rules where public FTP access is not a business requirement.
5. Audit for already-planted files: scan web-accessible directories for unexpected files (especially script files like .php, .jsp, .asp) that may have been placed via this vector prior to remediation.
6. Rotate credentials for any accounts whose configuration files may have been exposed via arbitrary file read before patching.

Detection Guidance

• FTP server/command logs: Review ProFTPD logs (TransferLog, ExtendedLog) for SITE CPFR and SITE CPTO command usage, particularly from anonymous sessions or involving paths outside a user’s home directory (e.g., /etc/, webroot paths).
• File integrity monitoring: Monitor web-accessible directories for newly created files immediately following FTP sessions, especially executable script types.
• Anomalous anonymous sessions: Alert on anonymous FTP logins followed by SITE command usage, since legitimate anonymous usage rarely issues copy commands.
• Exact IDS signatures should be sourced from current threat-intelligence or IDS vendor feeds (e.g., Suricata/Snort FTP protocol rule sets), as specific published signatures for this exploitation wave were not available in the data reviewed for this article.

Timeline

References

• ProFTPD Project
• Debian Security Advisory — proftpd-dfsg
• openSUSE Security Update Announcement
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 — Forensics Triage Requirements Implementation Guidance
• NVD — CVE-2015-3306