CVE-2015-3306 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2015-05-18

Added to CISA KEV: 2026-10-08 4161 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise — this vulnerability is in CISA KEV indicating active exploitation in the wild. Review FTP logs for SITE CPFR/CPTO commands issued by unauthenticated sessions, check web directories for unexpected PHP/shell files, review /etc/passwd and SSH authorized_keys for unauthorized modifications
IMMEDIATE: Upgrade ProFTPD to version 1.3.5a or later, or any version beyond 1.3.5 that patches this issue
IMMEDIATE: If upgrade is not immediately possible, disable or remove the mod_copy module by removing or commenting out 'LoadModule mod_copy.c' in proftpd.conf and restarting the service
Audit all files in web-accessible directories for recently created/modified PHP, Perl, or shell script files that may be web shells placed via this exploit
Review authentication logs for unexpected SSH logins or privilege escalation following FTP connections
Implement network-level controls: firewall rules to restrict FTP access to known IP ranges where possible, deploy FTP-aware IDS/IPS signatures detecting SITE CPFR/CPTO from unauthenticated sessions
Consider migrating from FTP to SFTP (SSH File Transfer Protocol) which does not have this exposure surface and provides encrypted transport
Monitor for IOCs associated with the Rex botnet if this server was exposed during 2015-2016 timeframe
PATCH PRIORITY: Critical — patch immediately if running ProFTPD 1.3.5 with mod_copy on any internet-accessible host

🔍 Web Intelligence (Kagi · 2026-10-08)

Summary

CVE-2015-3306 is a critical security vulnerability residing in the `mod_copy` module of ProFTPD version 1.3.5. This vulnerability allows remote, unauthenticated attackers to read and write arbitrary files on the underlying filesystem by leveraging the `SITE CPFR` (copy from) and `SITE CPTO` (copy to) commands. Because it bypasses typical file access restrictions, it matters significantly as it enables attackers to gain unauthorized access to sensitive configuration files, inject malicious code into web directories, or overwrite critical system files.

Exploitation

Active Exploitation: The vulnerability has been actively exploited in the wild, notably being used by attackers to gain unauthorized access and deploy web shells.
Threat Actors: It has been leveraged by various threat actors and was famously observed being exploited by the "Rex" botnet.
Proof-of-Concept/Exploit Tool Availability: Publicly available proof-of-concept exploits and automated scripts exist on platforms like GitHub, and modules are available in frameworks such as Metasploit.
Attack Prerequisites:

- Network vs. Local: It is a remote network-based attack. - Authentication: No authentication is required; the attacker can perform the commands as an unauthenticated user. - User Interaction: No user interaction is required.

Affected Products & Patches

Affected Product Versions: The primary affected version is ProFTPD 1.3.5.
Patch/Hotfix: This issue was addressed by the ProFTPD Project in subsequent releases; users are advised to upgrade to a patched version (1.3.5a or later).
Mitigation/Workarounds: If an immediate upgrade is not possible, the `mod_copy` module can be disabled or removed from the ProFTPD configuration to mitigate the vulnerability.

Impact

Access/Capability: Successful exploitation grants the attacker the ability to read arbitrary files (leading to sensitive data exposure like password hashes or configuration details) and write arbitrary files (leading to remote code execution, such as placing a web shell in a server directory).
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk of full system compromise, data theft, and the potential for the server to be used as a platform for further malicious activities, such as becoming part of a botnet or hosting phishing content.