published March 10, 2021
⚠️ An unauthenticated user can manipulate the subscriber database just by sending a carefully crafted HTTP request! Talk about a door left wide open! 🔥 Think of it like having a restaurant where anyone can walk in and change the menu items without anyone asking for their credentials — it’s a recipe for chaos! 🍽️ An attacker could create, read, update, or delete subscriber entries, potentially adding new administrative users or modifying existing ones. This could lead to unauthorized access and control over the system, leaving sensitive information vulnerable and putting the entire network at risk.
Think of it like having a restaurant where anyone can walk in and change the menu items without anyone asking for their credentials — it’s a recipe for chaos! 🍽️ This vulnerability in Open5GS versions 2.1.3 to 2.2.x before 2.2.1 allows unauthenticated API requests to bypass authorization checks, enabling undesired access to the subscriber database.
An attacker could create, read, update, or delete subscriber entries, potentially adding new administrative users or modifying existing ones. This could lead to unauthorized access and control over the system, leaving sensitive information vulnerable and putting the entire network at risk. Upgrade Open5GS to version 2.2.1 or later immediately. Implement authentication checks for all API requests to prevent unauthorized access. Regularly monitor your API for any suspicious activity. You've got this! Follow these steps and you’ll be back to hero status in no time! 🦸♂️