ProFTPD mod_copy arbitrary file write exploited (CVE-2015-3306) [PoC]

Actively exploited in the wild - CVE-2015-3306 is a critical arbitrary file read and write flaw in ProFTPD 1.3.5 that lets unauthenticated attackers copy any file on the server using the SITE CPFR and SITE CPTO commands. Upgrade to ProFTPD 1.3.5a or disable mod_copy immediately; exploitation is trivial and confirmed in the wild.

Overview

ProFTPD 1.3.5 ships with the mod_copy module enabled. This module adds two FTP commands: SITE CPFR (copy from) and SITE CPTO (copy to). These commands are handled before any authentication check, meaning an anonymous or unauthenticated connection can instruct the server to copy files on the underlying filesystem.

Because mod_copy does not restrict which paths can be used as source or destination, an attacker can copy a file they can read to a location they can write. The classic exploit chain copies a web shell into a web-accessible directory and then executes it over HTTP. An attacker can also copy sensitive files like /etc/passwd or SSH private keys to a readable FTP location and download them.

Impact

• Arbitrary file read: any file the ProFTPD process can read is exposed.
• Arbitrary file write: any file the ProFTPD process can write can be overwritten or created, including web roots.
• Remote code execution through a dropped web shell, if a web server shares the filesystem.
• Full server compromise without any credentials.

The CVSS score of 10.0 reflects network reachability, no authentication, no user interaction, and complete loss of confidentiality, integrity, and availability.

Remediation

1. Upgrade ProFTPD to 1.3.5a or later. This is the vendor’s fix for the flaw.
2. If upgrading is not possible right now, disable mod_copy by removing or commenting out the LoadModule mod_copy.c line in proftpd.conf, then restart the service.
3. Alternatively, restrict the module to authenticated users only, but this is a workaround, not a fix.
4. Audit the filesystem for unexpected files, especially in web-accessible directories, since exploitation may already have occurred.
5. Check ProFTPD logs for SITE CPFR and SITE CPTO entries from unknown clients.

Given the confirmed active exploitation and the 96.8% EPSS score, treat any internet-facing ProFTPD 1.3.5 instance as compromised until proven otherwise. Data breach reports are tracked at breach reports, and current coverage is available at security news.

Security Insight

CVE-2015-3306 is a textbook example of how a convenience feature becomes a catastrophe when it bypasses the authentication model entirely. The fact that SITE CPFR and SITE CPTO were reachable pre-login shows the original design treated FTP command handling as trusted, an assumption that stopped being safe the moment file copy became a primitive. A decade later, this CVE still earns a near-maximum EPSS score because so many embedded and legacy systems ship ProFTPD 1.3.5 unchanged, and nothing about the vulnerability requires skill to exploit. It is a reminder that the most dangerous flaws are often not memory corruption bugs but misplaced trust in the protocol layer itself.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs