FlawOpen

flawopen.com/Teardowns/cve-2015-3306-proftpd-mod-copy-unauthenticated-file-copy

● CVE-2015-3306 · CVSS 10.0 · Critical
FlawOpen Security Research

CVE-2015-3306: ProFTPD mod_copy unauthenticated file copying

CVE-2015-3306 let unauthenticated clients use ProFTPD mod_copy commands to copy files on the server. The upstream fix checks authentication in both SITE CPFR and SITE CPTO handlers; CISA added the issue to KEV on 2026-10-08. A joint FBI/CISA/NSA advisory published on October 8, 2026, lists CVE-2015-3306 among successfully exploited CVEs recovered from MicroScan scripts; it does not identify a victim or incident date for this CVE.[1], [2], [5], [6]

💡 Plain English Explainer (ELI5)

Think of a file-room clerk who accepts both “copy this file” and “put the copy here” requests from anyone at the door. Checking only one request is not enough: the source and destination steps must both belong to an authenticated session.[3]

Core Concepts & Subsystem Terms

SITE CPFR / SITE CPTO
ProFTPD mod_copy commands that select a source and destination for a server-side copy.[3], [5]
mod_copy
An optional ProFTPD module implementing server-side file-copy commands.[3], [5]
CWE-284
Improper access control: a protected operation can be reached without the authorization required by policy.[1]

Framework mappings

Root Cause Analysis

In affected ProFTPD 1.3.5 deployments with mod_copy available and enabled, copy_cpfr() and copy_cpto() accepted the SITE CPFR/SITE CPTO command path without requiring an authenticated session. The upstream PR #109 added an authenticated-state check to both handlers after basic command-dispatch checks but before minimum-argument validation, source/destination path processing, and copy operations, returning FTP 530 / EPERM when the session is not authenticated. The module still runs with the operating-system permissions of the ProFTPD process, so file impact is bounded by those permissions and configuration. Debian described arbitrary code execution as possible, not automatic; that outcome requires additional deployment-specific conditions such as a writable path consumed as code.[3], [5], [4]

Operator matrix: exposure and fixed-package checks

Deployment stateWhat the sources establishDefender action
ProFTPD 1.3.5 with mod_copy available and enabledUbuntu describes remote file read/write through SITE CPFR and SITE CPTO; NVD lists ProFTPD 1.3.5 as affected.Confirm the exact package build, module load state, and command exposure; upgrade using your distribution’s fixed package.
Upstream fix: PR #109 / commit 35b65aaThe patch adds authentication checks to both copy_cpfr() and copy_cpto() before the copy operations.Verify both commands reject unauthenticated sessions; keep filesystem permissions as a separate boundary.
Debian wheezy / jessie / stretch and sidDebian fixed these branches in 1.3.4a-5+deb7u3, 1.3.5-1.1+deb8u1, and 1.3.5-2, respectively.Compare the installed Debian package revision with the matching fixed version; do not rely on the upstream version string alone.
CopyEngine off supportPR #109 adds the directive; the module documentation states compatibility begins at 1.3.6rc1.Use CopyEngine off where the installed version supports it and the feature is not needed; otherwise remove the module or upgrade.

Step-by-Step Attack Flow

Step 1

Unauthenticated session reaches mod_copy

The issue applies when the affected module is present and its copy commands are exposed.[5], [1]

Step 2

Copy commands lack an authentication gate

Before the patch, CPFR and CPTO could proceed without verifying the session authentication state.[3]

Step 3

Server copies within its permission boundary

A requested copy can expose or alter files the daemon account can access; code execution is conditional on additional writable-path and application conditions.[5], [4]

Step 4

Patch gates both operations

The upstream change returns an authentication error from each handler before its copy logic.[3]

Source Code: Flaw vs. Secure Implementation

The vulnerable excerpt omits an authentication check in copy_cpfr(); the hardened excerpt inserts the upstream session-state guard before argument validation and state changes. PR #109 applies the same guard to copy_cpto(). This is a source excerpt, not a standalone program.[3]

UNPATCHED FLAW
/* Reduced excerpt from copy_cpfr() before upstream PR #109. */
if (cmd->argc < 3 ||
    strncasecmp(cmd->argv[1], "CPFR", 5) != 0) {
    return PR_DECLINED(cmd);
}
CHECK_CMD_MIN_ARGS(cmd, 3);
/* Source-path handling continues without an authentication check. */
HARDENED SECURE PATCH
/* Reduced excerpt from the upstream copy_cpfr() fix, PR #109. */
unsigned char *authenticated = NULL;
if (cmd->argc < 3 ||
    strncasecmp(cmd->argv[1], "CPFR", 5) != 0) {
    return PR_DECLINED(cmd);
}
authenticated = get_param_ptr(cmd->server->conf, "authenticated", FALSE);
if (authenticated == NULL || *authenticated == FALSE) {
    pr_response_add_err(R_530, _("Please login with USER and PASS"));
    pr_cmd_set_errno(cmd, EPERM);
    errno = EPERM;
    return PR_ERROR(cmd);
}
CHECK_CMD_MIN_ARGS(cmd, 3);

Engineering & System Hardening Checklist

Sources