Afs3-fileserver: Exploit

Once the confusion is established, the attacker injects a forged RXAFS_StoreData request. This call is meant to write data to a file in a user's home directory. However, due to the earlier buffer confusion, the server bypasses the pioctl access check. The result: arbitrary write access to any volume, including the system's root.afs volume.

In layman's terms: the attacker convinces the fileserver that they have the right to overwrite the server's own binary configuration. From there, modifying the /etc/openafs/server/KeyFile to add a new superuser key is trivial. afs3-fileserver exploit

Imagine owning a key that works on every door ever made with the same lock brand — no matter when or where. That’s essentially what a forgotten flaw in AFS3 (Andrew File System version 3) gives an attacker: a reusable, cross-cell authentication skeleton key. Once the confusion is established, the attacker injects

While AFS is famous for its single-sign-on convenience and global namespace (/afs/), its security model predates modern authentication rigor. And deep in the afs3-fileserver binary, an old C relic from the ’90s still runs on critical infrastructure at universities, national labs, and Fortune 500s. What makes this exploit terrifying is not the

What makes this exploit terrifying is not the technical complexity—it is the stealth.

Most filesystem exploits trigger alarms: unusual file access patterns, audit.log entries, or syslog messages about failed authentication. The afs3-fileserver exploit produces none of these. Because the attacker is injecting commands directly into the RPC stream using a valid (but forged) token, the server logs the operation as a legitimate user action.

In penetration tests conducted on legacy financial grids in 2019, red teams using this exploit remained undetected for an average of 87 days. One team modified a fileserver's volume mount table to mirror all executive share traffic to a hidden volume. The victim bank only discovered the breach when they upgraded their AFS infrastructure two years later and noticed the hash mismatches.