Description
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ProFTPD Project ProFTPD
Default version status: unaffected
0 to < 1.3.9eaffected1.3.10rc1 to < 1.3.10rc5affected
pkg:github/proftpd/proftpdReferences
- https://github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16 ↗
- https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_sftp/fxp.c#L4748 ↗
- https://github.com/proftpd/proftpd/releases/tag/v1.3.9e ↗
- https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5 ↗
- https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write ↗
- https://github.com/proftpd/proftpd ↗
- https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-mod-sftp-copy-file-authorization-bypass ↗