Summary

Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it.

Mitigations

To mitigate this protocol vulnerability, OpenSSH suggested a so-called "strict kex" which alters the SSH handshake to ensure a Man-in-the-Middle attacker cannot introduce unauthenticated messages as well as convey sequence number manipulation across handshakes.

Warning: To take effect, both the client and server must support this countermeasure.

As a stop-gap measure, peers may also (temporarily) disable the affected algorithms and use unaffected alternatives like AES-GCM instead until patches are available.

Details

The SSH specifications of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (-etm@openssh.com MACs) are vulnerable against an arbitrary prefix truncation attack (a.k.a. Terrapin attack). This allows for an extension negotiation downgrade by stripping the SSHMSGEXTINFO sent after the first message after SSHMSGNEWKEYS, downgrading security, and disabling attack countermeasures in some versions of OpenSSH. When targeting Encrypt-then-MAC, this attack requires the use of a CBC cipher to be practically exploitable due to the internal workings of the cipher mode. Additionally, this novel attack technique can be used to exploit previously unexploitable implementation flaws in a Man-in-the-Middle scenario.

The attack works by an attacker injecting an arbitrary number of SSHMSGIGNORE messages during the initial key exchange and consequently removing the same number of messages just after the initial key exchange has concluded. This is possible due to missing authentication of the excess SSHMSGIGNORE messages and the fact that the implicit sequence numbers used within the SSH protocol are only checked after the initial key exchange.

In the case of ChaCha20-Poly1305, the attack is guaranteed to work on every connection as this cipher does not maintain an internal state other than the message's sequence number. In the case of Encrypt-Then-MAC, practical exploitation requires the use of a CBC cipher; while theoretical integrity is broken for all ciphers when using this mode, message processing will fail at the application layer for CTR and stream ciphers.

For more details see https://terrapin-attack.com.

Impact

This attack targets the specification of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (-etm@openssh.com), which are widely adopted by well-known SSH implementations and can be considered de-facto standard. These algorithms can be practically exploited; however, in the case of Encrypt-Then-MAC, we additionally require the use of a CBC cipher. As a consequence, this attack works against all well-behaving SSH implementations supporting either of those algorithms and can be used to downgrade (but not fully strip) connection security in case SSH extension negotiation (RFC8308) is supported. The attack may also enable attackers to exploit certain implementation flaws in a man-in-the-middle (MitM) scenario.

ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in sizet but passed to newblock() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so newblock() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packetlen=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept.

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the modsftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the rootfs BSS global pointer to reference a fake filesystem struct, and redirect prfsiostat() to system() via a crafted RENAME request.

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers can exploit the subsequent conversion to uint32t, causing an approximately 4 GB requested read length and forcing the server to read beyond the end of the SSH channel data and write overread process memory into the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable exploitation of memory corruption vulnerabilities in the same process.

modsql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltabfetchclientscb() in contrib/modwrap2sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.

A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dircanonicalpath() to cause dircheck() to perform lexical path comparisons that match no configured Directory block, enabling rename operations on files in DenyAll-protected directories and subsequent retrieval of those files. Mitigation: Sessions configured with DefaultRoot (chroot) are not affected, as chroot changes the directory to which /proc/self/root resolves.

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in allocpool in pool.c, and possible remote code execution.

ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in modcap via the captext.c captotext function.

ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) modsqlmysql and (2) modsqlpostgres.

On 5/1/26 02:25, Valtteri Vuorikoski wrote: The official site <https://www.proftpd.org> seems to be down at the moment so I don't know if or how this has been officially announced. It is listed in the NEWS filed for the 1.3.9a release on their github repo: https://github.com/proftpd/proftpd/blob/1.3.9/NEWS

The bug report is also visible there: https://github.com/proftpd/proftpd/issues/2052

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

A third party advisory was posted announcing CVE-2026-42167, an SQL injection vulnerability in ProFTPd versions prior to 1.3.9a, at <https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce>. Exploitation requires use of modsql, which is apparently the case in many prepackaged shared hosting setups. (Reportedly this is also fixed in the pre-release version 1.3.10rc1.)

The official site <https://www.proftpd.org> seems to be down at the moment so I don't know if or how this has been officially announced. Quotes from the above advisory:

ZeroPath Research discovered a SQL injection vulnerability in ProFTPD's modsql extension. Depending on configuration, the flaw can be exploited before authentication and may lead to authentication bypass, privilege escalation, or remote code execution.

MITRE has assigned the flaw CVE-2026-42167 and rated it 8.1 on the CVSSv3 severity scale.

[...]

Timeline

2026-03-28 — Issue reported to ProFTPD maintainers 2026-04-07 — ProFTPD maintainers and ZeroPath work to verify patch 2026-04-24 — CVE-2026-42167 issued 2026-04-27 — Commit af90843baf7dcb8c6be1e5261be2d0b5b5850673 fixes issue 2026-04-27 — 1.3.9a released with fix

[...]

modsql

ProFTPD comes bundled with the modsql extension. When enabled, this extension can power a wide range of functionality, from quota tracking, to ban lists, to authentication.

Two capabilities are especially important for understanding CVE-2026-42167 and its impact. Authentication

Using the SQLAuthenticate and SQLUserInfo directives, an admin can configure ProFTPD to authenticate users against a SQL table instead of the local /etc/passwd file. This can come in handy for use cases like web hosting — it's not necessary to maintain full valid unix users for every FTP user, and it's quick to update user records in a centralized database. Logging

Using the SQLNamedQuery and SQLLog statements, an admin can configure ProFTPD to store its logs in a SQL database where they can be easily accessed and aggregated. Like its SQL authentication feature, this is especially useful for hosting services. The Flaw: CVE-2026-42167 Logging: Key Attack Surface

Admins configure what gets logged to SQL with statements like these:

SQLNamedQuery logactivity INSERT "'%U', '%r', '%m'" activitylog SQLLog logactivity SQLLog ERR logactivity

SQLLog selects particular commands to log. In this case all commands are logged. SQLNamedQuery specifies how to insert log entries into the database.

Critically, the SQLNamedQuery includes magic % expansions, which get replaced by data from the request. Many of these expansions are potentially attacker-controlled, including: Variable Meaning %A anonymous-login password string %J command parameters (everything after the verb) %S response message string (may include attacker input echoed back in errors) %U original username from USER (set before auth, available even on failed login) %d directory name (last path component) %l RFC 1413 ident response (attacker-controlled if they run identd) %m FTP method/verb (attacker chooses which command to send) %r full FTP command (verb + args) %u authenticated username %{basename} filename component of the path argument, no directory prefix

The attack surface here is obvious. Can an attacker use any of the parameters they control to slip an injection into an admin-configured SQLNamedQuery logging statement?

[Abbreviated code samples demonstrating that the answer is yes]

Impact: RCE, Auth Bypass, Privesc and More Access Necessary

What an attacker can do with this vulnerability depends on the admin's ProFTPD config. If the admin hasn't enabled modsql at all, or has not configured modsql-based logging, their instances are not vulnerable.

If modsql logging is enabled, the access an attacker needs to get up to mischief depends on how that logging is configured.

If pre-auth verbs like USER are logged, and that logging includes attacker-controlled values like %U (the username), an attacker only needs network access to the ProFTPD instance.

If post-auth verbs like STOR are logged in a way that includes attacker-controlled values, like the filename (%f), then the attacker must authenticate to exploit the issue (but this authentication can include anonymous FTP login if the server is configured for anonymous access).

RCE

When ProFTPD connects to Postgres with superuser privileges, the impact extends beyond database access. Existing Postgres command-execution primitives allow SQL injection to be escalated to remote code execution in this configuration. (See POCs for more details.) Auth Bypass And Privilege Escalation

In the more common case, where a non-Postgres datastore is used, or ProFTPD is not authenticating to Postgres with a superuser, attackers can bypass authentication or expand their privileges if modsql is configured for authentication via the SQLAuthenticate directive.

The malicious user simply inserts a record into the users table with the privilege, home directory and password that they desire. They then login as this user with the password they set.

If pre-auth input, like username, are logged, this means the attacker can bypass authentication altogether. Even in cases where the attacker can only insert a user record after authenticating, they can significantly expand their privilege — e.g. setting their home directory to / so that they can browse and download the entire filesystem, not just a constrained directory within it.

[...]

Mitigation

Upgrade ProFTPD to at least 1.3.9a If upgrade is not possible, disable logging via modsql Monitor ProFTPD instances for suspicious activity

[...]

ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections. Attackers can repeatedly establish connections using threading to exhaust server connection limits and block legitimate user access.

An arbitrary file copy vulnerability in modcopy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from modsql.

Multiple external config control vulnerabilities exist in the nas.cgi setnas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the ftpmaxsessions POST parameter.

Last updated 26 February 2025

modradius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters.

Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that the transport protocol implementation in ProFTPD had weak integrity checks. An attacker could use this vulnerability to bypass security features like encryption and integrity checks. (CVE-2023-48795) Martin Mirchev discovered that ProFTPD did not properly validate user input over the network. An attacker could use this vulnerability to crash ProFTPD or execute arbitrary code. (CVE-2023-51713) Brian Ristuccia discovered that ProFTPD incorrectly inherited groups from the parent process. An attacker could use this vulnerability to elevate privileges. (CVE-2024-48651)

Memory leak in ProFTPd 1.2.0rc2 allows remote attackers to cause a denial of service via a series of USER commands, and possibly SIZE commands if the server has been improperly installed.

ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response.

Off-by-one buffer overflow in xlateasciiwrite() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.

The prdataxfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service (CPU consumption) via an ABOR command during a data transfer.

modtls.c in ProFTPD 1.3.2a does not properly handle a '\0' character in a domain name in the subject's alternative name (subjectAltName) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Upstream bug report: -------------------- http://bugs.proftpd.org/showbug.cgi?id=3275

Upstream patch: --------------- http://bugs.proftpd.org/attachment.cgi?id=3096

A heap-based buffer overflow flaw was found in the way ProFTPD FTP server prepared SQL queries for certain usernames, when the modsql module was enabled. A remote, unauthenticated attacker could use this flaw to cause proftpd daemon to crash or, potentially, to execute arbitrary code with the privileges of the user running 'proftpd' via a specially-crafted username, provided in the authentication dialog.

Upstream bug report: [1] http://bugs.proftpd.org/showbug.cgi?id=3536

References: [2] http://www.securityfocus.com/bid/44933 [3] http://phrack.org/issues.html?issue=67&id=7#article [4] http://bugs.gentoo.org/showbug.cgi?id=348998 [5] http://proftpd.org/docs/RELEASENOTES-1.3.3d (ProFTPD v1.3.3d release notes)

CVE identifier: [6] http://www.openwall.com/lists/oss-security/2011/01/14/6

Multiple stack-based buffer overflows in the prnetiotelnetgets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.

Multiple directory traversal vulnerabilities in the modsitemisc module in ProFTPD before 1.3.3c allow remote authenticated users to create directories, delete directories, create symlinks, and modify file timestamps via directory traversal sequences in a (1) SITE MKDIR, (2) SITE RMDIR, (3) SITE SYMLINK, or (4) SITE UTIME command.