free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2.
The vulnerability consists of missing authorization control (CWE-862) on the route group handling the 3gpp-pfd-management API in the NEF component. An attacker reachable on the SBI network (Service Based Interface) can send HTTP requests with the 'Authorization: Bearer <any_value>' header and gain access to protected resources. Notably, the vulnerable route group is accessible even when the operator's configuration does not declare this service in the ServiceList field — meaning that service disabling through configuration does not provide actual protection.
An attacker can create, read, and delete PFD-management (Packet Flow Description) transaction state data, leading to integrity and availability violation of packet flow configuration in the 5G network core, as well as partial information disclosure.
free5GC should be updated to version 4.2.2 or later, where the bug has been fixed. Details of the patch are available in vendor references: https://github.com/free5gc/nef/pull/23
free5GC (open-source implementation of 5G network core) in all versions before 4.2.2, NEF (Network Exposure Function) component
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:HFree5gc
APPFree5Gc< 4.2.2
Related vulnerabilities
free5GC NEF: brak autoryzacji OAuth2 na trasach nnef-pfdmanagement
free5GC SMF: brak autoryzacji OAuth2 na endpointach UPI — pełny dostęp bez uwierzytelnienia
Brak autoryzacji OAuth2 w grupie tras OAM w free5GC NEF (5G core)
Brak autoryzacji OAuth2 w API NEF systemu free5GC (5G core)
CSRF w Free5GC umożliwia nieautoryzowane zarządzanie użytkownikami