free5GC UDR has improper `ueId` validation in EE subscription handlers that allows arbitrary identifier persistence

Vulnerability

The free5GC Unified Data Repository (UDR) EE subscription handlers HandleCreateEeSubscriptions and HandleQueryEeSubscriptions in api_datarepository.go improperly validate the ueId parameter. The validation regex ^(imsi-[0-9]{5,15}|nai-.+|msisdn-[0-9]{5,15}|extid-[^@]+@[^@]+|gci-.+|gli-.+|.+)$ ends with the catch-all alternative .+, which matches any non-empty string and bypasses the intended 3GPP identifier checks. This vulnerability affects all versions of free5GC containing the flawed regex; the tested deployment appears to be a standard free5GC release up to the date of the advisory [1][2].

Exploitation

An attacker able to reach the UDR SBI interface (e.g., from the internal network or via a compromised component) can send a crafted POST request to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions with an arbitrary ueId, such as ARBITRARY_STRING. The flawed regex accepts the value, and the handler stores the subscription record in the UDR database, returning HTTP 201 Created with a Location header pointing to the newly created resource. The same arbitrary identifier can then be retrieved using the corresponding GET endpoint, confirming persistence [1][2].

Impact

Successful exploitation allows an attacker to inject arbitrary ueId values into the UDR data store, polluting the database with non-standard identifiers and breaking trust boundaries that other network functions rely on. This can lead to unauthorized data creation, data corruption, and potential misrouting or misassociation of UE subscription information. The compromise is at the UDR data-model level, affecting the integrity and availability of subscription data for event exposure subscriptions [1][2].

Mitigation

As of the published advisory, no fixed version of free5GC has been released. The recommended mitigation is to correct the regex to remove the . |.+ alternation and enforce strict validation of 3GPP SUPI/GPSI identifier formats. Until a patch is applied, administrators should restrict network access to the UDR SBI endpoint and monitor for unexpected entries in the EE subscription tables. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date [1][2].