CVE-2015-3306: ProFTPD Improper Access Control Vulnerability
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Overview
The mod_copy module in ProFTPD 1.3.5 fails to require authentication before processing SITE CPFR and SITE CPTO commands, giving any remote client the ability to copy arbitrary files anywhere on the server filesystem. An attacker with network access to the FTP port can read sensitive files by copying them to a readable location, or write attacker-controlled content to a web-accessible path and achieve remote code execution. No credentials are required.
Vulnerability details
CWE-284 (Improper Access Control) describes a failure to enforce access restrictions on a privileged operation. In ProFTPD 1.3.5, the mod_copy module exposes two FTP SITE extension commands, CPFR (copy from) and CPTO (copy to), that together allow server-side file copies. The module processes these commands without first verifying that the requesting client has authenticated, so the server's normal session-based access controls are bypassed entirely. Any client that can reach the FTP port can invoke these commands against any path the ProFTPD process has permission to read or write.
An attacker sends unauthenticated SITE CPFR and SITE CPTO commands specifying arbitrary source and destination paths. At minimum this exposes sensitive files: copying /etc/passwd to a world-readable directory is a one-step operation. For remote code execution, the attacker injects a PHP snippet into the ProFTPD log or uses /proc/self/fd to stage content, then copies that content to a web-accessible directory such as /var/www, producing a functional webshell. This second stage requires a web server to be serving files from a path writable via CPTO, but the file-read primitive is available unconditionally.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor ProFTPD logs for SITE CPFR and SITE CPTO commands issued before any successful authentication event. A session containing these commands with no preceding login record is a strong indicator of exploitation.
- Alert on SITE CPFR or SITE CPTO commands referencing sensitive source paths such as /etc/passwd, /proc/self/fd, or ProFTPD log files, or destination paths inside web server document roots such as /var/www.
Remediation
Additional hardening
- Upgrade ProFTPD to a version beyond 1.3.5 that includes the mod_copy authentication fix; Debian packages the corrected build in version 1.3.5-1.1+deb8u1 (jessie) and 1.3.4a-5+deb7u3 (wheezy). See References for vendor and distribution advisories.
- Disable the mod_copy module entirely if server-side file copy functionality is not required. Remove or comment out the LoadModule mod_copy.so directive and restart the service.
- Restrict FTP port access to known, trusted source IP ranges using host-based firewall rules or network ACLs, reducing the pool of clients that can send unauthenticated SITE commands.
- Ensure the ProFTPD process runs under a dedicated low-privilege account with no write access to web server document roots, limiting the impact of any successful CPTO operation.
Key dates
References
- http://www.proftpd.org/
- https://lists.debian.org/debian-security-announce/2015/msg00154.html
- https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2015-3306
- http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
- http://www.debian.org/security/2015/dsa-3263
- http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
- https://www.exploit-db.com/exploits/36742/
Frequently asked questions
Does CVE-2015-3306 affect my FedRAMP authorization?
If ProFTPD runs inside your authorization boundary, yes. CVE-2015-3306 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its October 11, 2026 remediation deadline has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is an assessor finding. One that is past its deadline is a finding your assessor and sponsoring agency can already see. Your options now are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2015-3306?
Knox does not patch your ProFTPD installation. Under the FedRAMP shared-responsibility model, that remediation belongs to you. What Knox provides is the pre-authorized, single-tenant boundary in which you carry out that work, along with Knox's automated continuous monitoring platform and audit-artifact coverage that document the fix for your next assessment. The patch is yours to apply; maintaining a compliant posture while you apply it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2015-3306 surfaces, exposure is identified during ongoing monitoring rather than surfacing for the first time when an assessor reviews your posture at a scheduled assessment.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2015-3306's remediation deadline of October 11, 2026 has passed. What happens now?
An unremediated CVE-2015-3306 is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing the finding out now and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship in good standing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
