## 8 Vulnerability Assessment of NRF to API Injection Tests
### Open5 GS API Injection Tests  
To make a fair comparison between the two testbeds in spite of the limitations related to HTTP protocol, we developed the custom 5 GHTTPModifier tool to transform the requests exported from Burp Suite for OAI into HTTP/2 requests compatible with Open5 GS. The testing uncovered several security vulnerabilities within the Open5 GS framework.  
* SQL Injection: Requests containing SQL commands within the parameters are not rejected; instead, they are accepted and ignored. It is unclear whether there is a sanitization process in place. Regardless, all requests that do not conform to the schema specifications should be rejected. For example, if a parameter is declared as an integer but passed as a string, the entire API request should be rejected.
* GET-NF Instance (Store): This API requires two parameters, \"NFtype\" and \"Limit,\" but inconsistencies were discovered during testing:  
\begin{table}
\begin{tabular}{l l c} \hline \hline
**Method** & **Description** & **Number of Requests** \\ \hline DELETE & Subscription ID (Document) & 628 \\ \hline PATCH & Subscription ID (Document) & 630 \\ \hline POST & Subscription (collection) & 2398 \\ \hline DELETE & NF Instance ID (Document) & 628 \\ \hline PUT & NF Instance ID (Document) & 2987 \\ \hline PATCH & NF Instance ID (Document) & 630 \\ \hline GET & NF Instance ID (Document) & 761 \\ \hline GET & NF Instances (Store) & 820 \\ \hline OPTIONS & NF Instances (Store) & 550 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Requests sent through Burp Suite.  
Any non-existing NF entered in the \"NFtype\" parameter results in a response with all instances in the core network. * The \"limit\" parameter is declared as an integer, but no checks are performed on this parameter, allowing it to contain various data types, including OS/SQL commands or strings. * Changing the HTTP method from GET to POST in any request to this API causes the NRF to crash, leading to a DoS for the entire Core Network. * DELETE NF Subscription ID (Document) : This API contains an error that causes the network function to crash. Failing to enter any value for the requested parameter leads to the NRF becoming unresponsive. * DELETE NF Instance ID (Document): Similar to the previous API, this one also has an error that can crash the network function if no value is entered for the requested parameter. * PUT-NF Instance ID (Document): During some tests, network functions were recorded with dummy parameters, suggesting a potential security flaw. * OPTIONS-NF Instances (Store): Every request made to this API crashes the NRF. In summary, the tests lead to the following conclusions. * **Response Inconsistencies:** Similar to OAI, some API responses did not adhere to the standard JSON output format, leading to information leakage about the implementation, which could be exploited by attackers. * **Lack of Input Sanitization**: Similar to the OAI testbed, Open5 GS suffered from insufficient input validation. Requests with SQL commands as parameters were accepted and ignored, potentially leading to security risks. * **Improper Data Handling:** During testing, NFs were registered with dummy parameters, highlighting issues in the handling of data inputs. * **Crash on Invalid Inputs**: Certain API calls, such as deleting NF subscriptions and instances, could cause the entire core network to crash when provided with invalid inputs.