Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the missing authentication for the nnef-oam route group in free5GC's NEF component. The analysis of the provided patch and vulnerability description confirms that the root cause is in the server.NewServer function located in internal/sbi/server.go. This function was responsible for setting up the HTTP routes and failed to include an authentication middleware for the OAM service. As a result, any network attacker able to reach the NEF's SBI port could send requests to the /nnef-oam/v1/ endpoint without any authentication and have them processed.
The function that would be observed in a runtime profile during the exploitation of this vulnerability is processor.Processor.HandleOAMGet, which is the handler for the OAM GET requests. Although this handler itself is a simple stub, its execution without prior authentication is the manifestation of the vulnerability.
The fix, as seen in the commit, involves modifying server.NewServer to conditionally mount the route groups and apply an OAuth2 middleware, nef_util.NewRouterAuthorizationCheck, to the OAM route group, thus ensuring that all requests to this endpoint are authenticated.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/free5gc/nef | go | <= 1.2.3 |
