# free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication

free5GC UDR's influenceData subs-to-notify handler sends HTTP 400 but fails to return, leaking all subscriber SUPI/IMSI values unauthenticated.

- Payout: Research
- Severity: high
- Program: free5GC
- Found by: Giancannella, FrancescoDAlterio
- Disclosed: 2026-04-14
- CVE: CVE-2026-40245
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wrwh-rpq4-87hf
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-wrwh-rpq4-87hf
- Tags: area:devices domain:api domain:network impact:data-leak impact:pii-leak kind:research platform:ghsa sev:high tech:go tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** UDR SBI endpoint GET /nudr-dr/v2/application-data/influenceData/subs-to-notify
**Root cause:** Handler calls c.JSON(http.StatusBadRequest, problemDetails) on empty-parameter validation but omits return, so execution continues into the processor which writes the full subscription list to the same response. Same missing-return pattern in the snssai deserialization error branch.
**Steps:**
1. Send `curl -v "http://<udr-host>/nudr-dr/v2/application-data/influenceData/subs-to-notify"` with no query parameters and no credentials.
2. Handler detects all of dnn/snssai/internalGroupId/supi empty, writes 400 problemDetails, but does not return.
3. Processor ApplicationDataInfluenceDataSubsToNotifyGetProcedure runs and appends full subscription list to the body.
4. Response is HTTP 400 with error object followed by JSON array containing `supis` like `imsi-222777483957498`.
5. Alternate trigger: send malformed `snssai` parameter to hit the deserialization error branch's missing return.
**How found:** Code review of the generated OpenAPI handler: noticed the validation branch sends a 400 but lacks a return, so control falls through to the processor that writes data to the same response.
**Exploitation:** Any party with network reachability to the SBI (rogue NF, compromised internal host, misconfigured segmentation) issues a single unauthenticated GET and reads all stored Traffic Influence Subscriptions including SUPI/IMSI values, defeating SUCI privacy protections.
**Insight:** In OpenAPI-generated Go handlers, error branches that write a response without returning let the success path append data to the same body — grep generated api_*.go for `c.JSON(http.Status` not followed by `return` to find status/body mismatches.

## Proof of concept (copied exactly from the original report)

**Unauthenticated curl request leaking SUPI list**

```
curl -v "http://<udr-host>/nudr-dr/v2/application-data/influenceData/subs-to-notify"
Response (HTTP 400):
{"status":400,"detail":"At least one of DNNs, S-NSSAIs, Internal Group IDs or SUPIs shall be provided"}
[{"dnns":["internet"],
  "snssais":[{"sst":1,"sd":"000001"}],
  "supis":["imsi-222777483957498"],
  "notificationUri":"http://pcf.../npcf-callback/v1/nudr-notify/influence-data/imsi-222777483957498/1"}]
```