CVE-2026-42167: 
NixOS vulnerability analysis and mitigation

CVE-2026-42167 is a SQL injection vulnerability in ProFTPD's mod_sql extension that allows remote attackers to execute arbitrary code, bypass authentication, or escalate privileges by supplying a crafted username during FTP login. The flaw affects ProFTPD versions before 1.3.9a (and before the pre-release 1.3.10rc1), and is exploitable when SQL logging of USER requests is configured with attacker-controlled format expansions such as %U. It was discovered by ZeroPath Research, reported to ProFTPD maintainers on 2026-03-28, and patched on 2026-04-27 with the release of version 1.3.9a. The CVE was assigned on 2026-04-24 and published on 2026-04-28, with a CVSS v3.1 base score of 8.1 (High) (Github Advisory, oss-security).

The root cause is a logic error in the is_escaped_text() function within contrib/mod_sql.c (CWE-89: SQL Injection). When ProFTPD's mod_sql resolves format variables (e.g., %U for the original username) into SQL logging queries, it calls is_escaped_text() to determine whether escaping is needed — and skips escaping entirely if the value starts and ends with a single quote and contains no internal single quotes. An attacker can craft a username such as '|| (SELECT 1) ||' that satisfies this purely syntactic check, causing the function to treat attacker-controlled input as already-escaped and insert it raw into the SQL query. With PostgreSQL backends using PQexec() (which supports stacked queries), this enables full arbitrary SQL execution including COPY TO PROGRAM for OS command execution; with SQLite (sqlite3_exec()), stacked queries also work; MySQL is harder to exploit for writes due to mysql_real_query() not supporting CLIENT_MULTI_STATEMENTS by default. Exploitation requires no authentication when SQLLog ERR_* is configured to log failed USER commands with %U expansion (ProFTPD Issue #2052, ZeroPath PoC).

Successful exploitation can result in remote code execution on the database host (via PostgreSQL's COPY TO PROGRAM), authentication bypass, or privilege escalation. An unauthenticated attacker can inject a backdoor user record (with uid=0 and homedir=/) into the FTP authentication database, then log in with full filesystem access through the FTP daemon. In PostgreSQL deployments where the ProFTPD database role has superuser privileges, the attacker can execute arbitrary OS commands as the postgres OS user, enabling credential exfiltration, lateral movement, and persistence. All three CIA pillars — confidentiality, integrity, and availability — are rated High in the CVSS assessment (Github Advisory, oss-security).

Multiple public proof-of-concept exploits are available, including a comprehensive PoC repository from ZeroPath Research with five self-contained Python scripts targeting PostgreSQL and SQLite backends, covering both pre-auth and post-auth attack paths (ZeroPath PoC). Additional PoC repositories have been published by independent researchers (efeanilarslan PoC, jimmexploit PoC). The vulnerability is detectable by Nessus (plugin IDs 310830, 313411, 313412, 313413) and a Nuclei template has been published. The EPSS score is approximately 6.99–7.03% (92nd percentile), indicating elevated exploitation probability. No specific threat actor attribution or confirmed in-the-wild exploitation has been reported, and the vulnerability is not currently listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing ProFTPD servers (versions before 1.3.9a) using Shodan, Censys, or banner grabbing on port 21. Confirm the server version from the FTP banner.
2. Assess configuration: Determine if mod_sql logging is enabled with attacker-controlled format variables (e.g., %U) in SQLNamedQuery INSERT statements, and whether SQLLog ERR_* or SQLLog * is configured — enabling pre-auth exploitation via failed USER commands.
3. Craft malicious username: Construct a username payload that bypasses is_escaped_text() by starting and ending with a single quote and containing no internal single quotes, e.g., '|| (INSERT INTO users VALUES('attacker','$hash',0,0,'/','bash')) ||' or a COPY TO PROGRAM payload for RCE.
4. Send FTP USER command: Connect to the FTP server and issue USER <payload>. The server logs the failed login attempt, triggering the vulnerable sql_resolved_append_text() function, which inserts the raw payload into the SQL query without escaping.
5. Achieve objective (Auth Bypass): The stacked INSERT injects a backdoor user into the authentication table. Log in as the backdoor user with the chosen password to gain FTP access with the injected privileges (e.g., uid=0, homedir=/).
6. Achieve objective (RCE via COPY TO PROGRAM): If the ProFTPD DB role is a PostgreSQL superuser, craft the payload to include COPY (SELECT '') TO PROGRAM '<os_command>', executing arbitrary OS commands as the postgres user on the database host (ZeroPath PoC, oss-security).

• Network: Unusual FTP USER commands containing single-quote patterns (e.g., '||, ||') or SQL keywords (SELECT, INSERT, COPY, PROGRAM) in the username field; repeated failed login attempts with crafted usernames from a single source IP.
• Logs: ProFTPD access/auth logs showing USER commands with SQL-like payloads; SQL backend logs (PostgreSQL pg_log) showing unexpected INSERT INTO users, COPY TO PROGRAM, or stacked query execution originating from the ProFTPD connection.
• Database: Unexpected new user records in the FTP authentication table (e.g., users with uid=0, homedir='/', or recently created accounts not provisioned by administrators); unexpected tables or log entries created by injected SQL.
• File System: New files written via COPY TO PROGRAM or shell commands executed as the postgres OS user; unexpected cron jobs, SSH authorized keys, or scripts in postgres home directory or /tmp.
• Process: Unexpected child processes spawned by the PostgreSQL process (e.g., /bin/sh, bash, curl, wget, nc) indicating COPY TO PROGRAM execution (ZeroPath PoC, ProFTPD Issue #2052).

The primary remediation is to upgrade ProFTPD to version 1.3.9a or later (also fixed in pre-release 1.3.10rc1), which corrects the is_escaped_text() logic error in mod_sql (oss-security, Github Advisory). If immediate upgrade is not possible, disable SQL logging via mod_sql entirely, or remove attacker-controlled format variables (e.g., %U, %r, %m, %J, %{basename}) from SQLNamedQuery INSERT/UPDATE statements. Additionally, restrict the ProFTPD database role to the minimum necessary privileges — specifically, revoke PostgreSQL superuser status to prevent COPY TO PROGRAM escalation to OS command execution. Fedora and Slackware packages have been updated; check your distribution's security advisories for patched packages.

The vulnerability received broad coverage across security media outlets including GBHackers, CyberSecurityNews, Heise, and IT Security News, with headlines highlighting the risk to internet-facing FTP servers (GBHackers, Heise). The ZeroPath Research team published a detailed technical blog post and PoC repository, which was widely shared on Reddit's r/cybersecurity and r/blueteamsec communities, as well as on Mastodon and Bluesky. The Risky Biz newsletter also covered the vulnerability. Discussion on Hacker News (item 47949491) and oss-security mailing list threads confirmed community awareness and noted that many shared hosting deployments using mod_sql are likely affected by default configurations (oss-security).