Authorization Bypass in ProFTPD via mod_sftp Copy-File

Executive Summary

ProFTPD before versions 1.3.9e and 1.3.10rc5 has an authorization bypass in the mod_sftp copy-file extension handler. This flaw allows authenticated SFTP users to copy any readable file to a new path in directories where write access is denied. The vulnerability bypasses Limit WRITE checks for new destination files, enabling unauthorized file creation in restricted areas.

Useful 0 Not Useful 0

Impact Analysis

If you use ProFTPD with the mod_sftp module, an attacker with valid SFTP credentials could exploit this to write files to directories they shouldn't have access to. This could lead to data leakage, unauthorized file modifications, or further system compromise depending on the permissions of the affected directories.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ProFTPD to version 1.3.9e or later, or to 1.3.10rc5 or later if using a release candidate. This addresses the authorization bypass in the mod_sftp copy-file extension handler.

Useful 0 Not Useful 0