CVE-2015-3306 is an improper access control vulnerability (CWE-284) in the mod_copy module of ProFTPD. The SITE CPFR and SITE CPTO commands, which copy files on the server, can be used by an unauthenticated remote attacker to read and write arbitrary files that the FTP service account can reach. In practice an attacker can copy a PHP or script payload into a web-accessible directory and run it, which turns the file copy flaw into remote code execution. It carries a CVSS v2 score of 10.0; NVD has not published a CVSS v3 score.

The following ProFTPD versions are affected where the mod_copy module is loaded:

• ProFTPD 1.3.5 before 1.3.5a (NVD lists version 1.3.5); mod_copy must be enabled in the server configuration

Not affected / patched version:

• ProFTPD 1.3.5a, 1.3.6rc1 or any later release, including the current stable ProFTPD releases. Linux distributions also published backported fixes (for example Debian DSA-3263), so check the vendor package changelog

Successful exploitation may allow attackers to:

• Copy any file readable by the FTP service to another location, including configuration files and credentials, without logging in
• Write attacker-controlled files into web roots or other paths the service can write to, and run them as code
• Gain a foothold on a server, often a web or file-transfer host, and use it for malware hosting, data theft or movement into the internal network

CERTVU recommends the following:

1. Upgrade ProFTPD

   Upgrade to ProFTPD 1.3.5a or later, preferably the current stable release, and install distribution security updates.

2. Disable mod_copy if it is not needed

3. Reduce FTP exposure

4. Limit what the service can write

5. Hunt for compromise

   Search FTP logs for SITE CPFR and SITE CPTO commands from unauthenticated sessions, check web roots for unexpected PHP or script files, and report suspected compromise to CERTVU.