Improper access control in ProFTPD - CVE-2015-3306
Published: September 23, 2018 / Updated: April 19, 2024
Vulnerability identifier: #VU14904
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-3306
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to read and write files to the system.
The vulnerability exists due to improper access restrictions when handling CPFR and SITE CPTO FTP commends. A remote unauthenticated attacker can read and write arbitrary files on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
ProFTPD
Debian Linux
Fedora
Slackware Linux
proftpd
Debian Linux
Fedora
Slackware Linux
proftpd
How to mitigate CVE-2015-3306
Install updates from vendor's website.
proftpd - addressed in versions 1.3.5-5.el7, 1.3.5-5.fc21, 1.3.5-6.fc22
Links to Public Exploits and PoC-codes
- Exploit #9723 - ProFTPd-1.3.5-mod_copy-Remote-Command-Execution (Script that exploits the vulnerability of the ProFTPd 1.3.5 service with CVE-2015-3306) (April 19, 2024)
- Exploit #5580 - ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2) (June 17, 2021)
- Exploit #4715 - CVE-2015-3306-Python-PoC (Converted with tweaks from a metasploit module as an exercise for OSCP studying and exploit development) (October 18, 2020)
- Exploit #2669 - Modified-CVE-2015-3306-Exploit () (May 15, 2020)
- Exploit #2237 - exploit-CVE-2015-3306 (ProFTPd 1.3.5 - (mod_copy) Remote Command Execution exploit and vulnerable container) (March 29, 2020)
- Exploit #2117 - cpx_proftpd (Tool for exploit CVE-2015-3306) (March 18, 2020)
- Exploit #2119 - propane (Exploits the arbitrary file write bug in proftpd (CVE-2015-3306) attempts code execution) (March 18, 2020)
- Exploit #1428 - ProFTPd 1.3.5 - 'Mod_Copy' Command Execution (Metasploit) (March 18, 2020)
- Exploit #1429 - ProFTPd 1.3.5 - (mod_copy) Remote Command Execution (March 18, 2020)
- Exploit #1430 - ProFTPd 1.3.5 - File Copy (March 18, 2020)
- Exploit #1740 - ProFTPD 1.3.5 Mod_Copy Command Execution (March 18, 2020)
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
- http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
- http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html
- http://www.debian.org/security/2015/dsa-3263
- http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
- http://www.securityfocus.com/bid/74238
- https://www.exploit-db.com/exploits/36742/
- https://www.exploit-db.com/exploits/36803/