CVE-2015-3306 – Critical Remote Code Execution in ProFTPD

Key Takeaways:

• Critical CVSS 10.0 vulnerability in ProFTPD's mod_copy module
• Exploitable via site cpfr and site cpto commands for arbitrary file read/write
• Added to CISA KEV on 2026-10-08; patch deadline 2026-10-11 per BOD 26-04
• Affects ProFTPD 1.3.5 on Debian, Fedora, openSUSE, SUSE, and enterprise Linux
• Active exploitation observed in the wild as part of Flax Typhoon and other campaigns

Overview

CVE-2015-3306 is a Critical (CVSS 10.0) arbitrary file read/write vulnerability in ProFTPD 1.3.5's mod_copy module. Attackers can leverage site cpfr and site cpto commands to read or write to arbitrary filesystem paths, leading to full remote code execution on affected servers. The vulnerability has been tracked since 2015, was added to the CISA Known-Exploited-Vulnerabilities Catalog on 2026-10-08, and is currently being leveraged by tracked threat actors including Flax Typhoon.

Technical Details

The flaw resides in the mod_copy module of ProFTPD 1.3.5. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The attack vector is network-adjacent, low complexity, no privileges required, and no user interaction. Impact is complete loss of confidentiality, integrity, and availability. The vulnerability was originally disclosed in May 2015, but remained actively exploited through 2023–2026, prompting CISA's recent KEV addition and AA26-281A advisory alongside other N-days (ISC BIND, Apache Struts, ONLYOFFICE Docs, Strapi).

Severity & Impact

With a CVSS base score of 10.0 across both CVSS 2.0 and 3.1 frameworks, this vulnerability is rated Critical. The vector string confirms worst-case confidentiality, integrity, and availability compromise. Because the flaw allows arbitrary file read/write, an attacker with network access to the ProFTPD service can exfiltrate sensitive data, plant webshells or cryptominers, or achieve full system compromise. CISA's KEV entry and AA26-281A advisory classify this as an in-the-wild exploited flaw, meaning active attack campaigns are known.

Affected Products

ProFTPD 1.3.5 on the following platforms is affected:

• ProFTPD (upstream)
• Debian Linux 7.0–9.0
• Fedora 20–22
• openSUSE Tumbleweed
• SUSE Linux Enterprise Server 15 (sp7) For the full list of affected products, versions, and CPE URIs, see the <a href=https://vulnsocial.com/cve/CVE-2015-3306>CVE page.

Actionable Insights / What To Do

1. Patch ProFTPD to the latest fixed version immediately. Consult vendor advisories: Debian DSA-3263, Fedora/openSUSE/SUSE security updates, or compile from source with the mod_copy fix.
2. If patching is not immediately possible, disable the mod_copy module or restrict ProFTPD to internal networks only.
3. Audit all internet-exposed ProFTPD instances and verify version 1.3.5 or earlier.
4. Monitor logs for suspicious site cpfr and site cpto command sequences, especially on systems facing the internet.
5. Apply CISA BOD 26-04 guidance: prioritize this update per risk, and follow forensics triage requirements if exploitation is suspected.
6. Review CISA KEV page and AA26-281A advisory for additional context and timeline.

Remediation & Mitigation

• Update ProFTPD via your distribution's package manager: apt-get install proftpd, dnf update proftpd, zypper update proftpd, etc.
• Verify that the mod_copy module is either removed or compiled without the vulnerable code path.
• Restrict ProFTPD listening interfaces to trusted networks; disable public exposure where feasible.
• Review and rotate logs; look for cpfr/cpto command entries correlated with unexpected file changes or data exfiltration.

References

• CISA Known-Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306
• CISA Advisory AA26-281A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
• NVD CVE Record: https://nvd.nist.gov/vuln/detail/CVE-2015-3306
• Debian Security Advisory DSA-3263: https://www.debian.org/security/2015/dsa-3263
• Rapid7 Exploit Module: http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
• Packetstorm VDB Entry: http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
• Exploit-DB 36742: https://www.exploit-db.com/exploits/36742/
• Exploit-DB 36803: https://www.exploit-db.com/exploits/36803/
• Packetstorm CPFR/CPTO PoC: http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
• CISA KEV timeline & mentions: https://vulnsocial.com/cve/CVE-2015-3306

#CVE #Critical #RCE #CISAKEV #ProFTPD #CVE20153306