Improper Input Validation in free5gc Leads to DoS

Executive Summary

This vulnerability is a Denial of Service (DoS) flaw in free5GC v4.0.1. It occurs in the OAuth2 token handling logic of the Network Repository Function (NRF) component. When processing POST requests to the /oauth2/token endpoint, the handler crashes if a form key does not match any struct field in the NrfAccessTokenAccessTokenReq model. This triggers a panic due to Go's reflection system, causing the process to terminate and resulting in a DoS condition.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or panics in the free5GC NRF component, particularly when processing POST requests to the /oauth2/token endpoint. Check logs for unhandled form keys causing reflection panics. Use network traffic analysis to identify malformed POST requests with unexpected form keys targeting this endpoint.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can cause the free5GC NRF component to crash, disrupting network services that rely on it. This may lead to service outages, loss of connectivity for users, and potential cascading failures in the network infrastructure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to Denial of Service (DoS) conditions. A crash in the OAuth2 token handling logic may lead to unauthorized access risks or data processing interruptions, potentially violating availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update free5GC to a patched version if available. As a temporary fix, implement input validation to reject POST requests with unrecognized form keys before processing. Configure the NRF component to handle unknown form keys gracefully by returning HTTP 400 errors instead of crashing.

Useful 0 Not Useful 0