CVE-2022-45188

What it actually does

Heap-based buffer overflow in afp_getappl triggered by a crafted .appl file allows arbitrary code execution with remote root privileges on platforms such as FreeBSD.

Why it matters to the business

Attackers can achieve full system compromise on affected servers including TrueNAS appliances, enabling data theft, ransomware deployment, or persistent unauthorized access across the environment.

How an attack unfolds

An attacker crafts a malicious .appl file with oversized data, delivers it to a target running the Netatalk AFP service, and induces the service to process the file, triggering the overflow to execute attacker-controlled code.

How to fix it

Upgrade Netatalk to a version newer than 3.1.13. Apply the latest security patches from distribution maintainers for Debian and Fedora. Disable or restrict AFP access where possible until updates are applied.

How to confirm the fix worked

Confirm the installed Netatalk version exceeds 3.1.13, review AFP service logs for processing errors, and test file handling with benign inputs to verify stability.

Typical attack path

1. Create a specially crafted .appl file containing oversized data
2. Deliver the file to a system exposing the Netatalk AFP service
3. Trigger file processing via legitimate AFP operations
4. Exploit the resulting heap overflow to achieve code execution

How to detect it

Inspect Netatalk and AFP service logs for unexpected .appl file processing, crashes, or privilege changes; correlate with file creation events on shares.

What your security team should do

• Prioritize patching Netatalk on all affected hosts due to available public exploits
• Restrict AFP exposure to trusted networks only
• Implement file-type validation and sandboxing for AFP-processed files
• Monitor vulnerability disclosure feeds for downstream package updates