Finding Netatalk instances

(updated ), by Pearce Barry

A critical vulnerability in the Netatalk open source file server software was found in some popular network attached storage (NAS) devices. Netatalk provides services for the deprecated AFP (Apple Filing Protocol, formerly known as Appletalk Filing Protocol), and runs on a number of operating systems including Linux, FreeBSD, OpenBSD, NetBSD, and Solaris.

What is the impact of Mooncake?

Researchers with NCC’s Exploit Development Group discovered and disclosed this vulnerability, which has been assigned CVE-2022-23121 and dubbed “Mooncake”. It does require a writable file share for exploitation but does not require authentication, yielding root-level remote code execution. The report identified some popular NAS devices, including products in Western Digital’s MyCloud line, as running vulnerable versions of Netatalk in their distributed firmware.

Are updates available for the vulnerability?

Multiple vendors have made patches available to address the vulnerability. Project maintainers of Netatalk released version 3.1.13, which also included a number of other vulnerability fixes for “critical” and “high” scored CVEs. Users should either upgrade to this new release or consider disabling/removing Netatalk altogether in favor of SMB or NFS for network file shares. (Apple themselves no longer support AFP.) Western Digital also released updated firmware (v5.19.117) for affected devices, which removes Netatalk altogether from their firmware (and patched a number of other vulnerabilities). Western Digital recommends users upgrade to the latest firmware release and switch over to using SMB for network file sharing.

Synology NAS appliance and QNAP may be vulnerable

On April 28, 2022, Synology announced that some of their network-attached storage (NAS) appliances may be exposed to attacks exploiting Netatalk vulnerabilities. In addition to CVE-2022-23121 , Synology called out three vulnerabilities CVE-2022-23125, CVE-2022-23122, CVE-2022-0194 that allow attackers to run arbitrary code remotely on unpatched systems. Another NAS appliance maker, QNAP, also urged their customers to disable AFP until they’re able to resolve the Netatalk vulnerabilities.

Security updates for some of the impacted products may not be available yet. Affected customers are advised to check for updates frequently and apply them as soon as they are available.

How do I find potentially vulnerable Netatalk instances with runZero?

From the Asset Inventory, use the following pre-built query to locate assets within your network that could be running vulnerable versions of Netatalk:

port:548 AND (type:nas OR hw:"Western Digital")
Netatalk prebuilt query is available in the Queries Library

This query will surface NAS and Western Digital assets which appear to be running an AFP service, providing a starting point for additional investigation and triage.

As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.

Get runZero for free

Don’t have runZero and need help finding potentially vulnerable Netatalk instances?

Get started
Learn more about runZero

Similar Content

October 11, 2022

Finding FortiOS, FortiProxy, and FortiSwitchManager assets on your network

A critical authentication bypass vulnerability was found in the web administration interface of some Fortinet products. Tracked as CVE-2022-40684, successful exploitation of this vulnerability via crafted HTTP and HTTPS requests can provide remote attackers with admin-level …

September 30, 2022

Finding Microsoft Exchange Servers on your network

GTSC, a Vietnamese security firm, recently discovered two zero-day vulnerabilities that affect Microsoft Exchange Server 2013, 2016, and 2019. These two vulnerabilities are being tracked as CVE-2022-41040 and CVE-2022-41082.

August 4, 2022

Finding DrayTek Vigor routers

The Trellix Threat Labs Vulnerability Research team recently published vulnerability details affecting almost 30 models of DrayTek Vigor routers. This vulnerability resides in the management interface login page and is trivial to exploit via buffer overflow. An …

Read More