free5GC NEF vulnerabilities

In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the nnef-callback route group, allowing the use of a forged token to access the SMF-callback handler. The lack of authorization enables attackers to manipulate the actual subscription state.

In versions prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. An attacker can create a PFD subscription with an attacker-chosen notifyUri and trigger a PFD change, leading to NEF failure.

In versions prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without OAuth2/bearer-token authorization. A network attacker can use a forged token to access PFD application data and manage change-notification subscriptions.

In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the nnef-oam route group. A network attacker could access the OAM route without an authorization header, resulting in a 200 OK response.

In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the 3gpp-traffic-influence API. A network attacker could create, read, patch, and delete traffic-influence subscriptions without proper authorization headers.

free5GC is an open-source implementation of the 5G core network. Prior to version 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the PFD management API, allowing attackers to manipulate PFD transaction state using a forged token.