CVE-2025-69253
📋 TL;DR
The free5GC User Data Repository versions up to 1.4.1 leak detailed internal parsing error messages through the NEF component. This allows remote attackers to perform service fingerprinting and gather intelligence about the 5G core network implementation. All deployments using the Nnef_PfdManagement service are affected.
💻 Affected Systems
- free5GC User Data Repository
📦 What is this software?
Udr by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map internal service structures, identify software versions, and use this intelligence to plan targeted attacks against the 5G core network.
Likely Case
Information disclosure that enables reconnaissance and service fingerprinting, potentially revealing implementation details that could aid in developing further exploits.
If Mitigated
Limited information exposure with proper error handling, preventing attackers from gaining insights into internal system architecture.
🎯 Exploit Status
Exploitation requires sending malformed requests to trigger parsing errors and observing the detailed error responses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in free5gc/udr pull request 56
Vendor Advisory: https://github.com/free5gc/free5gc/security/advisories/GHSA-cj2h-x8qm-xgwc
Restart Required: Yes
Instructions:
1. Update free5GC UDR component to version containing commit 754d23b03755ad59077ed529ce3b971e477080c4
2. Apply the patch from pull request 56
3. Restart the UDR service
4. Verify error messages no longer contain internal parsing details
🔧 Temporary Workarounds
Network-level filtering
allImplement network filtering to block or sanitize error messages before they reach external clients
🧯 If You Can't Patch
- Implement reverse proxy or WAF to intercept and sanitize error responses
- Restrict network access to Nnef_PfdManagement service to trusted internal networks only
🔍 How to Verify
Check if Vulnerable:
Send malformed JSON requests to the Nnef_PfdManagement endpoint and check if detailed parsing errors (like 'invalid character') are returnedCheck Version:
Check free5GC UDR version or verify commit 754d23b03755ad59077ed529ce3b971e477080c4 is presentVerify Fix Applied:
After patching, send malformed requests and verify only generic error messages are returned without internal parsing details📡 Detection & Monitoring
Log Indicators:
- Detailed parsing error messages in application logs
- Multiple malformed requests to Nnef_PfdManagement endpoints
Network Indicators:
- Unusual patterns of malformed JSON requests to 5G core services
- Detailed error responses containing parsing information
SIEM Query:
source="free5gc-udr" AND (message="invalid character" OR message="parsing error")