Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in free5GC, an open-source 5G core network implementation. The issue allows unauthorized access to sensitive application data and control over notification subscriptions, potentially impacting network operations if exploited. The main concern is confirming relevance and exposure within your specific environment.
- Unauthorized access to 5G data and controls.
- Matters if you use open-source 5G core infrastructure.
- Verify if this open-source component is in use.
Attack Path
How an attacker could exploit the issue
An attacker who can reach the free5GC NEF component over the network can bypass authorization checks on the PFD management interface. This allows them to interact with PFD application data and subscription management functions without needing valid credentials.
- Network access to NEF required.
- Forged bearer token used to access routes.
- Unauthorized PFD data access and subscription changes.
Live Threat
Current exploitation, exposure, and threat context
Without proper authorization, an attacker could manipulate Packet Flow Description (PFD) application data and subscription information when the NEF (Network Exposure Function) is reachable via its Service-Based Interface (SBI). This could lead to unauthorized creation or deletion of PFD change-notification subscriptions.
- PFD application data and subscriptions at risk.
- Forged bearer tokens grant unauthorized access.
- Service behavior or data could be altered.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts the Network Exposure Function (NEF) within free5GC, affecting the management of PFD application data and subscriptions. Given that free5GC is an open-source 5G core network implementation, the primary responsibility for acting on this advisory likely falls to the infrastructure or platform teams managing the 5G core deployment. The first practical step is to identify all instances of free5GC, confirm their exposure to the Service-Based Interface (SBI), determine if they are business-critical, and then engage the accountable owner to plan remediation, potentially involving coordination with the free5GC community or vendor for the fix.
- Infrastructure and platform teams should own.
- Verify NEF SBI reachability and access controls.
- Plan for upgrading free5GC to a secure version.
