What this actually is.
Technical background, root cause, and affected surface.
Netatalk 2.2.1 through 4.4.2 calls system() after a failed chdir() without properly handling the error condition, which allows a local privileged user to execute unintended commands or cause a minor service disruption under specific conditions.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- Low
- CVSS Score
- 3
- Status
- Published
- CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
afpd/afp_unix.c or afpd/volume.c: chdir() return value not checked before subsequent system() call; execution continues on failure
Root cause: Missing error-return check on chdir(); system() called unconditionally regardless of chdir() success
When does this fire?
All conditions must be true for the exploit to succeed.
Local attacker controls the filesystem working directory of the afpd process and causes chdir() to fail to the attacker-controlled directory
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Limited OS command execution relative to an attacker-controlled working directory
C:N · I:L · A:L
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which adds chdir() return value checking and aborts on failure.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.