ProFTPD CVE-2015-3306: Analyzing the Critical mod_copy Vulnerability

A decade after its initial discovery, the ProFTPD improper access control vulnerability tracked as CVE-2015-3306 remains one of the most persistently targeted remote code execution flaws on public-facing Linux infrastructure. With a measured EPSS probability score of 96.8%—placing it in the 99.9th percentile for active exploitation—automated scanners and opportunistic threat actors continuously probe internet-facing deployments for unpatched instances of ProFTPD 1.3.5.

The Exploit Path: How mod_copy Abuse Works

The vulnerability exists in ProFTPD’s mod_copy module, which is compiled and enabled by default in affected releases. mod_copy introduces custom FTP commands—specifically SITE CPFR (copy from) and SITE CPTO (copy to)—designed to allow local server-side file transfers without routing data back through the client.

The security failure lies in access control enforcement: mod_copy processes these SITE commands prior to user authentication. An unauthenticated remote attacker connecting to port 21 can execute file read and write operations across the filesystem under the security context of the ProFTPD process (typically the nobody or ftp service accounts).

While arbitrary file copy capabilities might seem limited at first glance, the CVSS 3.1 score of 10.0 reflects a Scope Change (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because the vulnerability allows attackers to impact components outside the FTP daemon itself. The classic attack sequence weaponizes mod_copy to achieve full remote code execution:

1. Payload Staging: The attacker sends a crafted request containing PHP code or shell script commands to a service whose logs are predictable or accessible (such as a web server access log, or even directly into the FTP service connection string).
2. Arbitrary Copy (SITE CPFR): The attacker specifies the staged file or runtime memory file—such as /proc/self/cmdline or /var/log/proftpd/proftpd.log—as the copy source using SITE CPFR.
3. Webshell Delivery (SITE CPTO): The attacker issues SITE CPTO /var/www/html/shell.php to drop the file directly into a web server’s document root.
4. Execution: Navigating to http://<target>/shell.php executes the webshell with the privileges of the web daemon, granting persistent interactive command access.

In environments where ProFTPD runs with misconfigured permissions or elevated root rights, attackers bypass webshell staging entirely by using SITE CPTO to overwrite system files such as /root/.ssh/authorized_keys or drop scripts into /etc/cron.d/.

Target Profile and Exploitation Context

Because ProFTPD was historically bundled into numerous web hosting control panels, network-attached storage (NAS) devices, and enterprise Linux distributions, vulnerable 1.3.5 installations frequently persist on legacy systems or unmanaged perimeter assets.

Because the flaw requires zero authentication (PR:N), low attack complexity (AC:L), and no user interaction (UI:N), it is regularly integrated into automated exploitation frameworks and botnet propagation scripts targeting Linux environments for cryptomining, DDoS recruitment, and initial access sales.

Remediation and Technical Guidance

To address CVE-2015-3306, administrators should immediately implement one of the following technical controls:

• Upgrade Software: Update ProFTPD to version 1.3.5a or later, where mod_copy requires proper client authentication before executing copy commands.
• Disable mod_copy: If an immediate binary upgrade cannot be performed, disable the module by removing or commenting out LoadModule mod_copy.c in /etc/proftpd/modules.conf (or /etc/proftpd.conf) and restart the proftpd service.
• Enforce Command Limits: If mod_copy must remain active on an unpatched version, explicitly restrict access in proftpd.conf using a limit block:

  <Plugin mod_copy.c>
    <Limit SITE_COPYS>
      DenyAll
    </Limit>
  </Plugin>

• Forensic Detection: Inspect public web roots (e.g., /var/www/) and log directories for newly created executable files owned by the FTP service account (nobody or ftp). Search ProFTPD logs for unauthenticated commands matching SITE CPFR and SITE CPTO.