Netatalk is the open-source AFP server that powers AFP on Linux and the overwhelming majority of NAS appliances. Its request-parsing code has repeatedly carried pre-authentication memory-corruption bugs, out-of-bounds writes and related flaws in handling AFP requests and the associated data structures, that give remote code execution before any login. Because Netatalk typically runs as root (or a privileged service) on appliances, exploitation commonly yields root on the NAS, making an exposed, unpatched Netatalk one of the higher-value file-service targets.
# fingerprint Netatalk and its version
nmap -p548 --script afp-serverinfo <target> # server name/version string
# many NAS vendors bundle Netatalk; identify the device and its firmware version,
# then match the Netatalk version to the advisory for a pre-auth parsing bug
Exploitation notes#
- These are pre-authentication: reaching port 548 is the only precondition, so an internet- or network-exposed Netatalk with a lagging version is directly exploitable.
- Netatalk's prevalence on NAS appliances means a single bug affects many vendors' firmware at once, and the service's privilege usually makes the outcome device root.
- Fingerprint the Netatalk/firmware version and match to the specific advisory; these are version-specific memory-corruption exploits, so the version mapping is the key step.
- Distinct from the configuration issues (guest access, default credentials), this needs no credentials and no misconfiguration, only an unpatched version.