ProFTPD mod_copy: unauthenticated SITE CPFR/CPTO gives arbitrary file read and write

Impact

ProFTPD 1.3.5 with mod_copy enabled accepts the SITE CPFR and SITE CPTO commands without authentication, letting a remote attacker copy any file the daemon can read to any path it can write. That is arbitrary file read plus arbitrary file write as the service account, which on a conventional deployment is the standard route to code execution by writing into a web root or a path that something else executes. This matters for GPU and HPC estates that still run FTP on data-transfer or staging nodes: those hosts commonly mount the same shared filesystem the cluster trains from, so a write primitive there reaches dataset and job-script paths used by other tenants. CISA lists this as known exploited, and it is old enough that any remaining instance is likely unmanaged.

Who can reach it

Anyone who can reach the FTP port of an affected ProFTPD instance. No authentication and no valid account required.

What to do

Upgrade ProFTPD past 1.3.5 using your distribution's package (Fedora, Debian and openSUSE all shipped updates) and restart the daemon. If you cannot upgrade immediately, unload mod_copy in proftpd.conf and restart - that removes the vulnerable commands. Given its age and KEV status, the right move for most operators is to retire the FTP endpoint in favour of SSH-based transfer rather than patch it.

References

Related entries

• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• glibc through 2.29: heap buffer over-read in regexec during case-insensitive regex matchingCVE-2019-9169 · glibc regexec (proceed_next_node, case-insensitive matching)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• glibc 2.32/2.33: use-after-free in mq_notify of the caller's notification thread attributesCVE-2021-33574 · glibc mq_notify (POSIX message queue notification thread attributes)Critical
• OpenSSL: SM2 decryption understates the required buffer, overflowing it by up to 62 bytesCVE-2021-3711 · OpenSSL EVP_PKEY_decrypt (SM2 plaintext buffer size calculation)Critical