CVE-2021-46854: ProFTPD Information Disclosure Flaw

CVE-2021-46854 Overview

CVE-2021-46854 is a memory information disclosure vulnerability in the mod_radius module of ProFTPD, a popular open-source FTP server. The vulnerability exists in versions prior to 1.3.7c and allows sensitive memory contents to be disclosed to RADIUS servers due to improper handling of data blocks during authentication operations. The flaw stems from the module copying fixed 16-character blocks regardless of actual data length, potentially exposing uninitialized memory contents to external RADIUS authentication servers.

Critical Impact

Sensitive memory contents including potentially credentials, session tokens, or other confidential data may be leaked to RADIUS servers during authentication, enabling information disclosure attacks against ProFTPD deployments using RADIUS authentication.

Affected Products

• ProFTPD versions prior to 1.3.7c
• ProFTPD installations with mod_radius module enabled
• Systems using RADIUS authentication with ProFTPD

Discovery Timeline

• 2022-11-23 - CVE-2021-46854 published to NVD
• 2025-04-28 - Last updated in NVD database

Technical Details for CVE-2021-46854

Vulnerability Analysis

The vulnerability resides in the mod_radius module which handles RADIUS-based authentication for ProFTPD. When constructing RADIUS authentication packets, the module copies data in fixed 16-character blocks. This implementation flaw means that when the actual data is shorter than 16 characters, the remaining bytes contain uninitialized memory contents. These memory contents are then transmitted to the RADIUS server as part of the authentication packet.

This type of memory disclosure vulnerability (classified as CWE-401: Missing Release of Memory after Effective Lifetime) can expose sensitive information that happens to reside in adjacent memory locations. The network-accessible nature of this vulnerability means an attacker controlling or monitoring a RADIUS server could passively collect disclosed memory contents from vulnerable ProFTPD installations.

Root Cause

The root cause is improper memory handling in the mod_radius module's packet construction logic. The code copies fixed 16-byte blocks without properly initializing or clearing the destination buffer, and without bounds checking to ensure only the intended data is copied. This results in memory contents beyond the intended data being included in outbound RADIUS packets. The fix, addressed in GitHub ProFTPD Pull Request #1285, ensures proper buffer handling to prevent memory leakage.

Attack Vector

The attack vector is network-based and does not require authentication or user interaction. An attacker who operates a malicious RADIUS server, or has compromised a legitimate RADIUS server, can passively collect memory contents disclosed by vulnerable ProFTPD installations. The disclosed memory may contain:

• Fragments of user credentials from previous authentication attempts
• Session tokens or internal state information
• Configuration data or file paths
• Other sensitive information residing in server memory

The vulnerability is exploited passively during normal authentication operations, making detection difficult without network traffic analysis.

Detection Methods for CVE-2021-46854

Indicators of Compromise

• Unusual RADIUS packet sizes or malformed authentication requests originating from ProFTPD servers
• RADIUS traffic containing unexpected binary data or memory fragments
• Authentication packets with padding that contains non-null, non-random data patterns
• Evidence of RADIUS server compromise or unauthorized RADIUS server connections

Detection Strategies

• Audit ProFTPD version and verify mod_radius module status using proftpd -V command
• Analyze RADIUS authentication traffic for anomalous packet contents using network monitoring tools
• Review ProFTPD configuration files for mod_radius usage with grep -r "LoadModule mod_radius" /etc/proftpd/
• Implement network segmentation monitoring between FTP and RADIUS servers
• Deploy memory analysis tools to identify potential information leakage patterns

Monitoring Recommendations

• Enable detailed logging for RADIUS authentication events in ProFTPD configuration
• Monitor network traffic between ProFTPD servers and RADIUS infrastructure for unusual patterns
• Implement alerting for connections to unauthorized or unexpected RADIUS servers
• Review system logs for authentication anomalies or failed RADIUS communications

How to Mitigate CVE-2021-46854

Immediate Actions Required

• Upgrade ProFTPD to version 1.3.7c or later immediately
• If upgrade is not immediately possible, disable mod_radius module and use alternative authentication methods
• Audit RADIUS server logs for potential information disclosure
• Review network segmentation between FTP servers and RADIUS infrastructure
• Assess whether sensitive data may have been exposed through RADIUS communications

Patch Information

The vulnerability is addressed in ProFTPD version 1.3.7c and later. Administrators should upgrade to the latest stable release. Detailed patch information is available in the ProFTPD Release Notes 1.3.7e. The fix ensures proper buffer handling to prevent memory contents from being leaked in RADIUS packets. Additional security advisories are available from Gentoo GLSA 202305-03.

Workarounds

• Disable the mod_radius module if RADIUS authentication is not required
• Implement network isolation between ProFTPD servers and RADIUS infrastructure to limit exposure
• Use alternative authentication methods such as local authentication, LDAP, or SQL-based authentication
• Deploy a reverse proxy or firewall rules to control and monitor RADIUS traffic
• Consider encrypting RADIUS traffic using RadSec (RADIUS over TLS) to protect disclosed data in transit

# Configuration example
# Disable mod_radius in ProFTPD configuration
# Edit /etc/proftpd/proftpd.conf and comment out or remove:
# LoadModule mod_radius.c

# Verify ProFTPD version
proftpd -V | grep "Version"

# Check if mod_radius is currently loaded
proftpd -l | grep mod_radius

# Restart ProFTPD after configuration changes
systemctl restart proftpd