CVE-2010-20103

A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.proftpd.org/	Product
https://advisories.checkpoint.com/defense/advisories/public/2011/cpai-2010-151.html/	Third Party Advisory
https://github.com/proftpd/proftpd	Product
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb	Exploit Third Party Advisory
https://web.archive.org/web/20111107212129/http://rsync.proftpd.org/	Release Notes
https://www.exploit-db.com/exploits/15662	Exploit VDB Entry
https://www.exploit-db.com/exploits/16921	Exploit VDB Entry
https://www.vulncheck.com/advisories/proftpd-backdoor-command-execution	Third Party Advisory
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb	Exploit Third Party Advisory
https://www.exploit-db.com/exploits/15662	Exploit VDB Entry
https://www.exploit-db.com/exploits/16921	Exploit VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:proftpd:proftpd:1.3.3:c:*:*:*:*:*:*

History

No history.

Information

Published : 2025-08-20 16:15

Updated : 2025-09-24 17:02

NVD link : CVE-2010-20103

Mitre link : CVE-2010-20103

CVE.ORG link : CVE-2010-20103

JSON object : View

Products Affected

proftpd

proftpd

CWE

CWE-912

Hidden Functionality

{"id": "CVE-2010-20103", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-20T16:15:34.137", "references": [{"url": "http://www.proftpd.org/", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://advisories.checkpoint.com/defense/advisories/public/2011/cpai-2010-151.html/", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://github.com/proftpd/proftpd", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://web.archive.org/web/20111107212129/http://rsync.proftpd.org/", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/15662", "tags": ["Exploit", "VDB Entry"], "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/16921", "tags": ["Exploit", "VDB Entry"], "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/proftpd-backdoor-command-execution", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.exploit-db.com/exploits/15662", "tags": ["Exploit", "VDB Entry"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.exploit-db.com/exploits/16921", "tags": ["Exploit", "VDB Entry"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-912"}]}], "descriptions": [{"lang": "en", "value": "A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host."}, {"lang": "es", "value": "Una puerta trasera maliciosa se integr\u00f3 en official ProFTPD 1.3.3c source tarball, distribuido entre el 28 de noviembre y el 2 de diciembre de 2010. Esta puerta trasera implementa un disparador de comandos FTP oculto que, al ser invocado, provoca que el servidor ejecute comandos de shell arbitrarios con privilegios de root. Esto permite a atacantes remotos no autenticados ejecutar cualquier comando del sistema operativo en el host del servidor FTP."}], "lastModified": "2025-09-24T17:02:12.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:proftpd:proftpd:1.3.3:c:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15837EC9-F392-4ACD-A292-7ECD413D54BA"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}