External risk intelligence

ProFTPD mod_copy Arbitrary File Read Write Vulnerability

CVE advisoryKnown Exploit

CVE-2015-3306

ProFTPD is a widely used server-side application designed to facilitate file transfers. When deployed as an FTP server, it is typically configured to be network-reachable and often sits at the edge of a network to allow external users or systems to connect, upload, and download files.

Proftpd

1.3.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the ProFTPD file transfer software could allow unauthorized users to read and write to any file on a server. This type of security flaw, known as a critical vulnerability, can have significant implications for data integrity and system security.

Allows unauthorized file access and modification.
Critical flaw impacts data integrity and system security.
Assess relevance and exposure to protect sensitive data.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by connecting to a vulnerable FTP server over the network. Once connected, they can use specific commands to read and write arbitrary files on the server, potentially leading to the compromise of sensitive information or the execution of malicious code.

Network access is required.
Use of `site cpfr` and `site cpto` commands.
Arbitrary file read/write, potential code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to read and write to arbitrary files on a server running ProFTPD when the mod_copy module is enabled and supported by the advisory. This exposure is possible through specially crafted FTP commands.

Arbitrary file read/write access.
Via crafted FTP commands.
Potential for data corruption or loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

Infrastructure and platform teams are likely responsible for managing ProFTPD deployments. The first practical step is to identify all instances of ProFTPD, confirm their network reachability and business criticality, and then assign ownership for remediation planning based on the assessed risk.

Identify ProFTPD instances and assess exposure.
Confirm asset criticality and accountable owner.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ProFTPD and what is its role in a network?

ProFTPD is an open-source server application designed to manage file transfers using the FTP protocol. Organizations use it as a central hub where users or automated systems can upload, download, and store files. Because it facilitates these data movements, it is frequently installed on server infrastructure to support routine file management tasks across diverse environments.

What does CWE-284 mean regarding CVE-2015-3306?

CWE-284 refers to Improper Access Control. In the context of this vulnerability, it means the software fails to properly verify or restrict who can execute specific file management commands. Because of this weakness, the mod_copy module incorrectly allows unauthorized remote users to manipulate files, effectively bypassing the permissions that should prevent such access.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by connecting to an affected ProFTPD server over the network and issuing the 'site cpfr' (copy from) and 'site cpto' (copy to) commands. These commands are meant for file operations but are processed without the necessary security checks. If the mod_copy module is disabled, these specific commands are not available, which prevents this specific path of exploitation.

Do I need to worry if my ProFTPD instance is internal?

Halo Surface Signal notes that ProFTPD is often deployed at the network edge to facilitate external connections, which typically increases its risk profile. While internal instances are less accessible to the general public, they may still be reachable by internal actors or compromised machines within your network. You should prioritize assets based on their actual network reachability.

What should I do if I am running this technology?

Your first step is to create an inventory of all systems running ProFTPD to understand your footprint. Verify if the mod_copy module is enabled on those servers, as that is the primary component involved in this flaw. Once identified, evaluate the network exposure of these instances and follow your organization's standard procedures to plan and apply the necessary security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.