What this actually is.
Technical background, root cause, and affected surface.
A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- High
- CVSS Score
- 7.5
- Status
- Published
- CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
afpd/volume.c or afpd/unix.c: shell metacharacter check uses (char_a | char_b) instead of (char_a || char_b), defeating the filter
Root cause: Typo: bitwise OR (|) used instead of logical OR (||) in security-sensitive input validation condition
When does this fire?
All conditions must be true for the exploit to succeed.
Authenticated AFP client with volume configuration access supplies shell metacharacters in a field that is passed to system()/popen()
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Arbitrary OS command execution with the privileges of the afpd daemon (root)
C:H · I:H · A:H
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which corrects the operator and properly validates shell metacharacters.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.