Finding Netatalk instances

(updated ), by Pearce Barry
icon

A critical vulnerability in the Netatalk open source file server software was found in some popular network attached storage (NAS) devices. Netatalk provides services for the deprecated AFP (Apple Filing Protocol, formerly known as Appletalk Filing Protocol), and runs on a number of operating systems including Linux, FreeBSD, OpenBSD, NetBSD, and Solaris.

What is the impact of Mooncake?

Researchers with NCC’s Exploit Development Group discovered and disclosed this vulnerability, which has been assigned CVE-2022-23121 and dubbed “Mooncake”. It does require a writable file share for exploitation but does not require authentication, yielding root-level remote code execution. The report identified some popular NAS devices, including products in Western Digital’s MyCloud line, as running vulnerable versions of Netatalk in their distributed firmware.

Are updates available for the vulnerability?

Multiple vendors have made patches available to address the vulnerability. Project maintainers of Netatalk released version 3.1.13, which also included a number of other vulnerability fixes for “critical” and “high” scored CVEs. Users should either upgrade to this new release or consider disabling/removing Netatalk altogether in favor of SMB or NFS for network file shares. (Apple themselves no longer support AFP.) Western Digital also released updated firmware (v5.19.117) for affected devices, which removes Netatalk altogether from their firmware (and patched a number of other vulnerabilities). Western Digital recommends users upgrade to the latest firmware release and switch over to using SMB for network file sharing.

Synology NAS appliance and QNAP may be vulnerable

On April 28, 2022, Synology announced that some of their network-attached storage (NAS) appliances may be exposed to attacks exploiting Netatalk vulnerabilities. In addition to CVE-2022-23121 , Synology called out three vulnerabilities CVE-2022-23125, CVE-2022-23122, CVE-2022-0194 that allow attackers to run arbitrary code remotely on unpatched systems. Another NAS appliance maker, QNAP, also urged their customers to disable AFP until they’re able to resolve the Netatalk vulnerabilities.

Security updates for some of the impacted products may not be available yet. Affected customers are advised to check for updates frequently and apply them as soon as they are available.

How do I find potentially vulnerable Netatalk instances with runZero?

From the Asset Inventory, use the following pre-built query to locate assets within your network that could be running vulnerable versions of Netatalk:

port:548 AND (type:nas OR hw:"Western Digital")
Netatalk prebuilt query is available in the Queries Library

This query will surface NAS and Western Digital assets which appear to be running an AFP service, providing a starting point for additional investigation and triage.

As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.

Get runZero for free

Don’t have runZero and need help finding potentially vulnerable Netatalk instances?

Get started
Learn more about runZero

Similar Content

August 4, 2022

Finding DrayTek Vigor routers

The Trellix Threat Labs Vulnerability Research team recently published vulnerability details affecting almost 30 models of DrayTek Vigor routers. This vulnerability resides in the management interface login page and is trivial to exploit via buffer overflow. An …

Read More

July 29, 2022

Hunting for X.509 Certificates

X.509 certificates are used to secure communications over both trusted and untrusted networks. Protocols such as Transport Layer Security (TLS) rely on X.509 certificates to keep their communications secure between endpoints. Each X.509 certificate is composed of a public …

Read More

June 21, 2022

Finding Microsoft VPN/PPTP with runZero

Last month, researcher Alex Nichols at Nettitude reported a vulnerability in Microsoft’s Windows VPN software that could allow for remote code execution or local privilege escalation by an attacker. This vulnerability lies in a use-after-free condition that can occur in the …

Read More