GHSA-5f62-53r8-qrqf: free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Summaryfree5GC's NEF mounts the `3gpp-pfd-management` API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. `Authorization: Bearer not-a-real-token`). The route group is also reachable even when the running config's `ServiceList` does not declare it, so operators who think they disabled the service via config are still exposed.DetailsValidated against the NEF container in the official Docker compose lab.Source repo tag: `v4.2.1`Running Docker image: `free5gc/nef:v4.2.0`Runtime NEF commit: `5ce35eab`Docker validation date: 2026-03-11NEF advertises `OAuth2 setting receive from NRF: true`, and its `ServiceList` only declares `nnef-pfdmanagement` and `nnef-oam`. Despite that, the `3gpp-pfd-management` route group is mounted and reachable with no inbound auth middleware.Code evidence (paths in `free5gc/nef`):Route group mounted without auth middleware: `NFs/nef/internal/sbi/server.go:52`Transaction routes exposed at `/:scsAsID/transactions` and `/:scsAsID/transactions/:transID`: `NFs/nef/internal/sbi/api_pfd.go:13`Create handler still contains `// TODO: Authorize the AF`: `NFs/nef/internal/sbi/processor/pfd.go:70`POST allocates a new PFD transaction and writes to UDR: `NFs/nef/internal/sbi/processor/pfd.go:63`GET reads transaction state: `NFs/nef/internal/sbi/processor/pfd.go:189`DELETE removes transaction state: `NFs/nef/internal/sbi/processor/pfd.go:328`NEF context only exposes outbound token acquisition (`GetTokenCtx`); there is no inbound authorization path: `NFs/nef/internal/context/nef_context.go:153`Config validation only allows `nnef-pfdmanagement` and `nnef-oam`: `NFs/nef/pkg/factory/config.go:126`PoCReproduced end-to-end against the running NEF at `http://10.100.200.19:8000` using a fabricated bearer token.Seed an AF context (also accepted with forged token):CREATE PFD transaction with forged token -> `201 Created`:READ -> `200 OK`:DELETE -> `204 No Content`:READ again -> `404 PFD transaction not found`, confirming state was actually deleted.NEF container logs (`docker logs nef`) show the requests reaching business handlers and returning success codes:ImpactMissing inbound authentication (CWE-306) and authorization (CWE-862) on a critical SBI surface in NEF. Any party that can reach NEF on the SBI network can:Create attacker-controlled PFD transactions (which are written to UDR), poisoning policy state used downstream by SMF/UPF for traffic classification.Read existing PFD transactions, leaking AF-supplied policy data.Delete PFD transactions, denying service to legitimately provisioned application detection rules.The PFD-management route group is also reachable even when the runtime `ServiceList` does not declare it, so operators relying on `ServiceList` to disable the service do not actually get that protection.Affected: free5gc <=v4.2.1.Upstream issue: https://github.com/free5gc/free5gc/issues/858
Upstream fix: https://github.com/free5gc/nef/pull/23
CVSS v3.1: 9.4