Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/free5gc/nef | go | <= 1.2.3 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because the 3gpp-traffic-influence API endpoints were exposed without any authentication or authorization checks. The root cause lies in the internal/sbi/server.go file within the NewServer function, where the HTTP routes for traffic influence were mounted without the necessary OAuth2 middleware. This allowed unauthenticated network attackers to send requests directly to the business logic handlers in internal/sbi/processor/ti.go.
The vulnerable functions, PostTrafficInfluenceSubscription, GetIndividualTrafficInfluenceSubscription, PatchIndividualTrafficInfluenceSubscription, and DeleteIndividualTrafficInfluenceSubscription, which handle the CRUD operations for traffic influence subscriptions, were therefore completely unprotected. An attacker could create, read, update, and delete traffic steering policies, leading to traffic redirection, information disclosure, and denial of service.
The fix, identified in commit b16537cc7ffe779c15155fe5cd23b015e1404e80, introduces a middleware (RouterAuthorizationCheck) that performs an OAuth2 token check for all requests to the 3gpp-traffic-influence route group. The NewServer function was modified to apply this middleware, ensuring that only authenticated and authorized requests can reach the underlying handler functions.
