CVE-2023-4659

Executive Summary

CVE-2023-4659 is a critical Cross-Site Request Forgery (CSRF) vulnerability in the Free5GC core network platform that allows an unauthenticated remote attacker to perform privileged administrative actions, including creating, deleting, and modifying user accounts within the application. The vulnerability stems from the application's failure to properly validate or require CSRF tokens, which is further exacerbated by the ability to bypass the platform's role-based access control by simply changing the token value to "admin". With a CVSS score of 9.8, this vulnerability exposes any internet-facing Free5GC management interface to complete administrative takeover, making it a critical risk for 5G core network testbeds and production deployments that expose their web management consoles. The CISA KEV does not list this CVE, and no public exploit code or PoC has been confirmed at the time of writing.

Technical Analysis

Free5GC is an open-source 5G Core (5GC) network implementation widely used for research, education, and prototyping of 5G standalone (SA) networks. The project includes a web-based management console that provides administrators with the ability to manage subscribers, network slices, and user accounts within the 5G core environment.

The vulnerability described in CVE-2023-4659 is classified as a Cross-Site Request Forgery (CSRF) flaw. The NVD description reveals two critical weaknesses in the platform's request handling mechanism:

1. Predictable Token Bypass: The application's CSRF protection mechanism is fundamentally broken. According to the NVD description, an attacker can achieve administrative privileges by simply changing the token value to the literal string "admin". This indicates that the application does not implement a cryptographically random CSRF token (such as a server-side session-bound nonce); instead, it appears to rely on a hardcoded or trivially guessable token value. In a properly implemented CSRF defense, the token would be a session-specific random value generated server-side and validated against the server-side session state on every state-changing request. The fact that "admin" is accepted as a valid token suggests that the server either hardcodes this value, validates the token insecurely, or does not validate it at all but merely checks for its presence in the request.

2. Complete Absence of Token Validation: The description further states that "it is also possible to perform POST, GET and DELETE requests without any token value." This confirms that the application's CSRF protection is not enforced at all — HTTP requests with standard CSRF headers/parameters are accepted even when the token is entirely absent. This means the application lacks server-side validation of any anti-CSRF mechanism, effectively nullifying CSRF protections.

The attack surface includes all HTTP endpoints that handle state-changing operations, particularly those pertaining to user management. Given that the application accepts GET requests for state-changing operations (as explicitly noted in the NVD description — GET requests are listed alongside POST and DELETE), this substantially broadens the exploitation surface. Legacy HTTP clients, CSRF attack payloads, and even simple hyperlinks can trigger destructive actions.

The vulnerability class is CSRF (CWE-352), but given the broken token implementation and the explicit mention that requests can be made without any token, this effectively functions as an authentication bypass for the administrative role. Combined, these issues mean that a remote unauthenticated attacker can perform full administrative CRUD operations (Create, Read, Update, Delete) on user accounts within the Free5GC web application.

This is especially dangerous in the context of 5G core networks, where the management console is the primary interface for provisioning network slices (network endpoints), subscriber profiles (SIM card identities), and authentication credentials. User account manipulation within the Free5GC application directly impacts the integrity and availability of the 5G core's subscriber database (UDM/UDR), potentially allowing an attacker to impersonate legitimate subscribers or disrupt network services.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1: Reconnaissance and Target Identification

The attacker first identifies exposed Free5GC web management consoles. Free5GC's UI is typically accessible over HTTP/HTTPS on the management network (commonly port 5000 or similar web console ports, though the specific port is not disclosed in the NVD description). Attackers can use Shodan or mass scanning of IP address space to identify the Free5GC management console based on HTTP responses, page titles, or known JavaScript framework signatures. Due to the 5G testbed nature of many Free5GC deployments, exposed instances are commonly found on research networks, university labs, or poorly segmented enterprise test environments.

Step 2: Triggering the Vulnerability

The attacker crafts HTTP requests targeting the user management endpoints. Because the application accepts requests without any CSRF token, and because the token "admin" is sufficient to authenticate administrative operations, the attacker has two exploitation paths:

• Direct exploitation: The attacker sends crafted HTTP requests (POST, GET, or DELETE) directly to the web console's user management endpoints, either without any token or with the token value set to "admin". This is a trivial request — no CSRF token generation, session hijacking, or user interaction required.
• Leveraged CSRF: The attacker could also embed these requests in a malicious HTML page (e.g., a form auto-submitting via JavaScript, or a GET-based link) and trick an authenticated administrator into visiting the page. However, given that the token bypass allows completely unauthenticated exploitation, this second path is likely unnecessary — direct remote exploitation is the more probable attack vector unless network segmentation prevents direct access.

Step 3: Payload Execution

At the vulnerability-class level, the attacker executes standard CSRF-style payloads — HTTP requests that modify application state. The NVD description specifies that the attacker can create, delete, and modify users. A typical attack would:

1. Create a rogue administrator account: The attacker sends a POST request to the user creation endpoint, providing a username, password, and setting the role/authorization token to "admin", thereby gaining persistent administrative access.
2. Modify existing users: The attacker could change admin passwords (locking out legitimate administrators) or escalate the privileges of existing lower-tier accounts.
3. Delete users: The attacker could remove legitimate user accounts, effectively locking out authorized personnel and creating a denial-of-service condition at the management layer.

The key enabler is the lack of the server-side session validation: the application trusts a hardcoded token value "admin" and accepts anonymous requests with no token at all.

Step 4: Post-Exploitation Impact

Once administrative access is obtained, the attacker gains full control over the Free5GC management platform. This extends to the underlying 5G core configuration: subscriber data, network slice settings, authentication credentials, and inter-NF (network function) communication parameters. The attacker could:

• Provision rogue subscribers (SIM credentials) that bypass normal operator controls.
• Modify network slice configurations to degrade or deny service to legitimate subscribers.
• Extract or alter authentication vectors, potentially enabling subscriber impersonation at the radio network level.
• Use the compromise as a pivot point deeper into the enterprise network, given the high-value positioning of core network infrastructure.

Impact Assessment

CVSS Score: 9.8 (Critical) — The high score reflects the remote, unauthenticated nature of the vulnerability (AV:N/AC:L/PR:N/UI:N), combined with complete impact on Confidentiality, Integrity, and Availability (C:H/I:H/A:H — per the CVSS vector string derived from the score components).

Business Impact:

• Confidentiality: Administrative access to the Free5GC platform exposes subscriber data, including IMSIs, MSISDNs, authentication keys (Ki values), and network configuration details. Unauthorized access to this data constitutes a significant data breach in telecom-grade environments.
• Integrity: An attacker can modify or create user accounts, and by extension, alter subscriber profiles and cryptographic material used for network authentication. This can enable subscriber identity spoofing and unauthorized network access.
• Availability: The ability to delete users and alter core configuration can render the management platform and, in turn, the 5G core network non-functional, constituting a denial-of-service condition.

Blast Radius: The affected system is the Free5GC web management console. In research and educational deployments, the blast radius may be limited to the lab environment. However, in enterprise or operator environments where Free5GC is deployed beyond prototyping (which the vendor encourages for edge/MEC deployments), the blast radius includes the entire 5G core subscriber database and the operational availability of the network. Because Free5GC controls authentication (AMF/UDM) and subscription (UDR) functions, a full compromise directly impacts connected RAN (radio access network) nodes and all subscriber devices.

EPSS Context: EPSS score of 0.00330 (25.6th percentile) indicates that, as of the scoring date, this vulnerability is not widely exploited in the wild. This is consistent with Free5GC's niche user base and the lack of confirmed public exploit code. However, the simplicity of exploitation and the severity of impact warrant immediate attention.

Detection Guidance

Sigma Rule

title: Free5GC Web Console - Potential CSRF Exploitation / Admin Token Bypass
id: 3f8c2d1e-2a5b-4c7d-9f1e-8a9b2c3d4e5f
status: experimental
description: Detects HTTP requests to Free5GC web management console that lack CSRF tokens or use trivial token values such as "admin", which may indicate exploitation of CVE-2023-4659.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4659
author: Valtersit Threat Intelligence Team
date: 2024/01/15
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for Free5GC web console'
detection:
    selection_csrf_token_admin:
        csrf-token|equals: 'admin'
        csrf_token|equals: 'admin'
        token|equals: 'admin'
    selection_missing_token_state_changing:
        http-method:
            - 'POST'
            - 'DELETE'
        csrf-token|contains: null
        csrf_token|contains: null
        token|contains: null
        http-body|contains|all:
            - 'user'
            - 'password'
    selection_state_changing_get:
        http-method: 'GET'
        http-body|contains|all:
            - 'user'
            - 'create'
    condition: selection_csrf_token_admin or selection_missing_token_state_changing or selection_state_changing_get
    timeframe: 5m
falsepositives:
    - 'Legitimate API clients that do not implement CSRF tokens'
    - 'Internal automation scripts managing the Free5GC platform'
level: high

YARA Rule

rule Free5GC_CSRF_Token_Bypass_CVE_2023_4659 {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2024-01-15"
        description = "Detects traffic or payloads containing CSRF tokens set to 'admin' or missing tokens targeting Free5GC user management endpoints"
        cve = "CVE-2023-4659"
        score = 80
    strings:
        $token_admin = "admin" ascii wide nocase
        $no_token_condition = "token=" ascii wide nocase
        $get_user_action = "user" ascii wide nocase
        $http_post = "POST" ascii wide nocase
        $http_delete = "DELETE" ascii wide nocase
        $content_type_form = "application/x-www-form-urlencoded" ascii wide nocase
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize < 10MB and
        (($token_admin and ($http_post or $http_delete or $http_content_type)) or
        (filesize < 10KB and $token_admin and $get_user_action))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"FREE5GC CVE-2023-4659 CSRF Token Bypass Admin Token"; flow:to_server,established; content:"token=admin"; http_uri; sid:1000001; rev:1; metadata:cve CVE-2023-4659; classtype:attempted-admin;)
alert http any any -> $HOME_NET any (msg:"FREE5GC CVE-2023-4659 CSRF Missing Token User Delete"; flow:to_server,established; http.method; content:"DELETE"; http.method; content:"user"; http_uri; pcre:"/(user|subscriber|account)/i"; sid:1000002; rev:1; metadata:cve CVE-2023-4659; classtype:attempted-admin;)
alert http any any -> $HOME_NET any (msg:"FREE5GC CVE-2023-4659 CSRF Missing Token User Creation"; flow:to_server,established; http.method; content:"POST"; http.method; content:"user"; http_uri; content:"password"; http_client_body; pcre:"/(create|add|new)/i"; sid:1000003; rev:1; metadata:cve CVE-2023-4659; classtype:attempted-admin;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where event.action == "connection_established" and destination.port == 5000 ]
  [ http where
      http.request.method in ("POST", "DELETE") and
      http.request.body.content contains "token=admin" and
      http.request.body.content contains ("user", "subscriber")
  ]

Splunk SPL Query

index=proxy OR index=web
| where (http_method="POST" OR http_method="DELETE") AND (body LIKE "%token=admin%" OR body NOT LIKE "%token=%")
| where uri LIKE "%user%" OR uri LIKE "%subscriber%" OR uri LIKE "%account%"
| table _time, src_ip, dest_ip, uri, http_method, response_code, body
| sort - _time

Wazuh OSSEC Rule

<group name="free5gc,cve-2023-4659,">
  <!-- Free5GC CSRF Token Admin Value Detection -->
  <rule id="100301" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(free5gc|webui|console).*token=admin</field>
    <description>Free5GC CVE-2023-4659: CSRF token set to 'admin' detected - possible exploitation</description>
    <group>free5gc,cve-2023-4659,attack.initial_access,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <!-- Free5GC State-Changing Request Without CSRF Token -->
  <rule id="100302" level="12">
    <decoded_as>json</decoded_as>
    <field name="http_method">POST|DELETE</field>
    <field name="url">(user|subscriber|account|profile)</field>
    <description>Free5GC CVE-2023-4659: State-changing request without CSRF token detected</description>
    <group>free5gc,cve-2023-4659,attack.initial_access,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A patch is claimed by the CNA but not independently confirmed at this time. Validate the fix before relying on it.

1) Immediate Mitigations

• Restrict network access: Place the Free5GC web console behind a VPN or restrict access to trusted management subnets only. Do not expose the management interface to the internet or to untrusted segments.
• Implement identity-aware proxy: Deploy an authentication reverse proxy (e.g., nginx with basic auth or OAuth2 proxy) in front of the Free5GC UI as a stopgap measure to enforce authentication at the network edge.
• Traffic monitoring: Activate detection rules (Sigma, Suricata, Splunk, etc. as above) on the perimeter and at the host level to detect attempted exploitation.
• Audit user accounts: Review all user accounts in the Free5GC platform for unauthorized or unexpected accounts immediately, and periodically thereafter.

2) Patch/Upgrade Steps

• Update Free5GC to the latest version available from the official repository (https://github.com/free5gc/free5gc). The latest release should include the CSRF fix.
• Verify the fix by checking the commit history/release notes for CSRF-related changes. If unavailable, perform a manual test: attempt to send a POST request to the user creation endpoint without a token and with a token value of "admin" — both should be rejected if the patch is effective.
• If the latest version does not address the CSRF token issue, do not deploy it into production; instead, rely on the network-level mitigations above.

3) Long-Term Hardening

• Implement a Web Application Firewall (WAF) with CSRF protection rules as a defense-in-depth layer.
• Enforce session management: Ensure the application validates session-bound, cryptographically random CSRF tokens on all state-changing requests, including GET requests (or better, change state-changing GET endpoints to POST/DELETE).
• Network segmentation: Isolate the 5G core management plane from user-facing networks and the general corporate LAN following the 3GPP network security architecture principles.
• Adopt secure CI/CD for the Free5GC deployment with automated security scanning including SAST/DAST checks to catch similar flaws in future versions.
• Monitor CVE sources and vendor advisories for confirmed patch details and any follow-up vulnerabilities in Free5GC.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-4659
2. Free5GC Official GitHub Repository: https://github.com/free5gc/free5gc
3. CWE-352 (Cross-Site Request Forgery): https://cwe.mitre.org/data/definitions/352.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. Free5GC Website: https://free5gc.org

Known Exploitation in the Wild: No public evidence exists of CVE-2023-4659 being exploited in the wild at the time of writing. The EPSS score of 0.00330 (25.6th percentile) indicates low active exploitation likelihood relative to other CVEs. CISA KEV does not list this vulnerability. No threat actor campaigns have been publicly attributed to this CVE.