What this actually is.
Technical background, root cause, and affected surface.
An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- Medium
- CVSS Score
- 4.2
- Status
- Published
- CWE
- CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
afpd/ldap.c: LDAP filter construction concatenates AFP client-supplied username or group input without escaping LDAP special characters
Root cause: User input incorporated into LDAP filter strings without RFC 4515 special character escaping
When does this fire?
All conditions must be true for the exploit to succeed.
Authenticated AFP client supplies input containing LDAP filter metacharacters (parentheses, asterisks, backslashes) in username or group fields passed to LDAP queries
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Unauthorized LDAP directory enumeration; potential modification of LDAP entries
C:L · I:L · A:N
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which implements proper LDAP filter input escaping per RFC 4515.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.