free5GC UDR Leaks Server Information to Remote Clients

Summary

Before version 1.4.1 of free5GC's User Data Repository, sensitive server information can be exposed to attackers. This information can help attackers identify the server's software and how it works. To fix this issue, update to version 1.4.1 or apply the provided patch.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
free5gc	udr	<= 1.4.1	–

Original title

free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Versions prior to 1.4.1 contain an Improper Error Handling vulnera...

Original description

free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Versions prior to 1.4.1 contain an Improper Error Handling vulnerability with Information Exposure. All deployments of free5GC using the Nnef_PfdManagement service may be affected. The NEF component reliably leaks internal parsing errors (e.g., invalid character 'n' after top-level value) to remote clients. This can aid attackers in fingerprinting server software and logic flows. Version 1.4.1 fixes the issue. There is no direct workaround at the application level. The recommended mitigation is to apply the provided patch.

nvd CVSS3.1 5.3

nvd CVSS4.0 2.7

Vulnerability type

CWE-209

https://github.com/free5gc/free5gc/issues/753 Exploit Issue Tracking Patch Vendor Advisory
https://github.com/free5gc/free5gc/security/advisories/GHSA-f3pc-w7jp-4jh2 Patch Vendor Advisory
https://github.com/free5gc/udr/commit/91bb34bd96e1c89b3fddca80db8b90049da61ebb Patch
https://github.com/free5gc/udr/pull/56 Issue Tracking Patch