Horizon Alert
Summary of the vulnerability and why it matters
This Cross-Site Request Forgery vulnerability in the free5gc webconsole allows unauthenticated attackers to perform administrative actions, such as creating, deleting, or modifying users, by manipulating token values.
- Unauthenticated users can alter application data.
- Management interfaces require vigilant oversight.
- Confirm relevance and assess potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by tricking an administrator into visiting a malicious link, which then allows the attacker to perform actions as that administrator. This is possible because the web console does not properly validate security tokens, or any token at all, when processing requests. This could enable an unprivileged remote user to create, delete, or modify users within the application.
- No special access required.
- Manipulated requests trigger vulnerability.
- Unauthorized user management possible.
Live Threat
Current exploitation, exposure, and threat context
A Cross-Site Request Forgery vulnerability allows an unprivileged remote attacker to perform administrative actions on the platform, such as creating, deleting, and modifying users, by manipulating token values or submitting requests without a token. This could occur when an administrator is tricked into interacting with a malicious link or website.
- User and application data may be compromised.
- Unauthenticated requests can modify application data.
- Unauthorized user creation and modification.
Operational Fix
Recommended remediation, mitigation, and detection steps
This Cross-Site Request Forgery vulnerability in the free5gc webconsole allows unprivileged remote users to perform administrative actions, including user creation, deletion, and modification, by manipulating tokens or sending requests without them. This poses a critical risk, enabling unauthorized control over the platform. Action is required from teams responsible for managing and securing the free5gc webconsole. The first practical step involves identifying all instances of the affected webconsole, assessing their network exposure and business criticality, and locating the accountable system owners to plan remediation.
- Application and infrastructure owners should lead remediation.
- Verify all webconsole instances and their reachability.
- Plan risk-based remediation actions.
