ProFTPD 1.3.5 mod_copy Arbitrary File Read/Write and Remote Code Execution (CVE-2015-3306)

Affected Vendors

ProFTPD Project

Affected Components

ProFTPD

Published Date

2015-05-18

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

ProFTPD version 1.3.5 with the mod_copy module enabled.

Impact

Unauthenticated remote attackers can read or write arbitrary files, leading to sensitive data exposure or full system compromise via RCE.

Mitigation

Upgrade to ProFTPD 1.3.5a or later, or disable the mod_copy module in the configuration file.

Affected Products & Version Scope

ProFTPD version 1.3.5 (when mod_copy is compiled and loaded).

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Disable Module: If patching is not immediately possible, disable the mod_copy module in proftpd.conf.

bash

# In proftpd.conf
# Comment out or remove the following line:
# LoadModule mod_copy.c

Update Software: Upgrade to ProFTPD version 1.3.5a or newer where this issue is resolved.
Network Filtering: Use an IPS or WAF to monitor and block unauthorized SITE CPFR and SITE CPTO commands over the FTP control channel.

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Organizations using ProFTPD 1.3.5 must immediately apply security updates or disable the mod_copy module to prevent unauthorized file manipulation and RCE.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

The vulnerability stems from improper access control in the mod_copy module, which implements the SITE CPFR (Copy From) and SITE CPTO (Copy To) commands. These commands allow users to copy files on the server without transferring them over the network. Because these commands are processed before authentication is required in certain configurations, an attacker can move sensitive system files to a web-accessible directory or inject malicious code (e.g., a PHP shell) into the web root. This vulnerability is listed in the CISA KEV catalog, indicating high active exploitation in the wild.