Local Open5GS Lab APT Exposure Map

#mobility #open5gs #ueransim #srsran #lab #attack-path

Local Open5GS Lab APT Exposure Map

Observed topology

The repository at /Users/tester/code/CodeCollector/mobility/lab supplies a Docker Open5GS core, UERANSIM SA UE/gNB, srsRAN configurations, and threat-probe tests. The live macOS lab has the core and UERANSIM 5G SA path; NSA material is a control-plane study on the Linux gateway, not a full production EN-DC deployment.

UERANSIM UE --- N1/NAS --- UERANSIM gNB --- N2/NGAP ---> AMF
      |                               |
    TUN/N6                           N3/GTP-U
      |                               v
      +----------------------------> UPF5G ---- data network

 AMF / SMF / AUSF / UDM / UDR / PCF / NSSF / BSF
                 | HTTP/2 cleartext SBI :7777
                 v
               NRF / SCP
                 |
                 v
        MongoDB subscriber store

 4G side: MME <--- Diameter No_TLS ---> HSS
          SMF <--- Diameter No_TLS ---> PCRF
          MME/SGWC <--- control ---> SGWU/UPF4G

Exact file map

Priority	Repository file	Observed condition	Attack vector / vulnerable condition	Where activity would appear	Existing coverage	Recommended action
P0	`lab/core/docker-compose.yml`	`gradiant/open5gs:2.7.6` is the shared NF image.	Open5GS 2.7.6 is within the NVD affected range for NRF CVE-2025-41067. Version reuse also makes image provenance a common-mode risk.	NRF logs/restarts, disappearing NF registry, Docker events, image digest drift.	`sbi-malformed.py` checks malformed-input survival but is not a CVE reproduction.	Upgrade to a fixed upstream release after compatibility testing; until then isolate SBI, snapshot registry state, alert on NRF restart/registry collapse, and pin image digest.
P0	`lab/core/config/5g/nrf.yaml`; all `lab/core/config/5g/*.yaml`	SBI listeners and service URIs use port 7777 and cleartext `http://`.	A host or container with Docker-network reachability can interact with NF APIs without transport peer identity. TS 33.501 supports TLS and service authorization; other network protection is possible only if explicitly designed.	NRF NF-management events; NF logs; connections to 7777; Docker network attachment; packet capture.	`nrf-unauth-reg.py` demonstrates accepted NF registration without an Authorization header; `sbi-malformed.py` covers robustness.	Add a production-like mTLS/OAuth or protected service-mesh profile as a second lab mode; enforce source/network policy and preserve current mode as the insecure control case.
P0	`lab/core/docker-compose.yml` DB URIs	`mongodb://10.74.0.2/open5gs` has no credentials; WebUI is host-bound to `127.0.0.1:9999`, but MongoDB is reachable to the internal lab network. Checked-in image is MongoDB 4.4.29; the local compatibility override uses 6.0.	Any compromised attached container can read or change subscriber data. Both 4.4 and 6.0 are past MongoDB community lifecycle support as of this research date.	Mongo connections, subscriber document changes, WebUI activity, container network attachment, DB process logs.	`mongo-isolation.py` checks isolation assumptions; subscriber seed flow proves write path.	Enable authentication/audit where available, bind/segment strictly, move to supported release on compatible hardware, and record before/after hashes of the synthetic subscriber.
P0	`lab/core/docker-compose.yml`	UPF5G and UPF4G run `privileged: true` and `user: root`; SGWU is privileged. AMF/MME and UERANSIM receive `NET_ADMIN`.	Host/container escape or compromised NF has a larger blast radius; raw packet/routing changes can hide or redirect traffic. This is a privilege configuration, not a CVE.	Docker inspect/events, namespace and route drift, iptables/nftables, new capabilities, unexpected processes.	No dedicated privilege-drift test.	Reduce capabilities and privileged mode where TUN/GTP implementation permits; baseline inspect output and route/firewall state.
P1	`lab/core/freeDiameter/hss.conf`, `mme.conf`, `pcrf.conf`, `smf.conf`	Peers use `Port = 3868; No_TLS;`.	A foothold on the internal network can observe or impersonate a trusted Diameter peer if peer/source controls are insufficient.	CER/CEA peer identity, new TCP/3868 source, DWR/DWA churn, HSS/MME/PCRF/SMF logs.	No dedicated Diameter peer-auth test.	Create a TLS-enabled comparison profile, restrict peers by network policy, and alert on Origin-Host/Realm changes.
P1	`lab/core/ueransim/ue.yaml`	`protectionScheme: 0`; all-zero home-network public key; static K and OP are committed.	Null SUCI protection exposes SUPI semantics in lab signaling; repository or host access exposes synthetic authentication material. These are intentional test values, not product CVEs.	NAS PCAP, UE/AMF log identity fields, Git/file access, subscriber DB comparison.	`suci-privacy.py`; authentication and tamper-rejection tests.	Keep values synthetic, add a protected-SUCI profile, prevent reuse, and scan evidence bundles for keys/SUPI before publication.
P1	`lab/core/config/5g/amf.yaml`; `lab/core/config/4g/mme.yaml`	AMF allows `[NIA2, NIA1, NIA0]` and `[NEA2, NEA1, NEA0]`; MME allows EIA0/EEA0 last.	Null algorithms may be selected in approved emergency/test conditions, but make downgrade/state-machine mistakes more consequential. This is a policy condition, not proof of downgrade vulnerability.	NAS Security Mode Command/Complete, selected algorithm, AMF/MME log, session rejection/acceptance.	`null-cipher-block.py` and NAS test plans.	Add a strict profile with null modes removed; assert that ordinary attach never selects null and document exceptions.
P1	`lab/core/seed_subscribers.sh`	Script writes a canonical synthetic subscriber and authentication material to MongoDB.	A management-plane attacker can use the same provisioning path to create or modify an identity if execution and DB access are not controlled.	Shell history/process audit, Git change, Mongo diff, WebUI/API logs.	Seed and cleanup behavior are deterministic.	Add change manifest and post-test diff; separate seed authority from runtime NF containers.
P1	`lab/tp/tests/nrf-unauth-reg.py`	Test intentionally sends a PUT with no Authorization and records acceptance as a lab gap.	Demonstrates missing NF-level authorization inside the trusted lab network. It does not establish Internet exposure.	Test JSON/evidence, NRF logs, registry create/delete event.	Direct existing validation.	Retain as regression control; add a hardened-profile expectation of 401/403 and workload identity evidence.
P1	`lab/core/ueransim-compose.yml`	gNB/UE use `NET_ADMIN`; UE receives `/dev/net/tun`; image is local `mobility-lab/ueransim:v3.2.7`.	Compromised image or process can manipulate interfaces/routes and observe synthetic user traffic.	Image digest/build provenance, container inspect, TUN routes, packet capture, process list.	Lab self-test and attach tests validate function, not provenance.	Generate SBOM/digest, restrict build inputs, baseline route changes, and rebuild reproducibly.
P2	`lab/ran/5gsa/gnb_zmq.yml`; `lab/ran/5gnsa/.conf`, `.yml`, `zmq_endc_broker.py`	Checked-in radio/control-plane configuration determines core address, PLMN, tracking area, bands, and ZMQ endpoints.	Repository or host modification can redirect attachment, alter identifiers, or break availability. No vendor OAM plane is present.	Git diff, config hash, srsRAN/UERANSIM command line and log, unexpected remote endpoint.	Functional SA/NSA study procedures.	Sign/baseline configs and add a preflight that refuses non-loopback ZMQ or unapproved core endpoints.
P2	`lab/systemd/mobility-docker-lan-isolation.service`	Network isolation depends on a host service and current rule state.	Service failure or rule drift can expose the lab Docker network beyond the intended host/gateway boundary.	systemd status/journal, applied firewall rules, routes, external reachability test.	Isolation test exists at the lab level.	Make rule-state verification part of every `core-up`; fail closed and attach evidence.

Likely attack sequences in this lab

Path A — host or supply-chain compromise to all core functions

A malicious or replaced image, repository change, or host administrator session changes the compose/config inputs.
Docker launches an altered NF or grants access to the core network.
The new workload reaches NRF, MongoDB, PFCP, Diameter, and GTP peers.
Privileged packet-plane containers extend impact into routes and user traffic.

Most useful evidence: image digest and SBOM, Git diff, Docker create/exec/network events, mounted-file hashes, process list, route/firewall snapshots.

Path B — internal foothold to 5G control plane

A compromised container or host process reaches TCP/7777.
Because the lab lacks SBI transport identity and the NRF accepts unauthenticated registration, the foothold can present itself as an NF or invoke permitted API behavior.
Discovery/state manipulation can affect downstream NF selection or availability.
CVE-2025-41067 adds a separate NRF availability risk for this version; it should not be conflated with the missing-authorization gap.

Most useful evidence: source container/IP, NF profile delta, request path/status, NRF restart count, registry continuity, correlated deployment event.

Path C — subscriber data modification

An attached workload connects to unauthenticated MongoDB or an operator uses the WebUI/provisioning script.
Synthetic K/OP, SUPI, APN/DNN, slice, or policy data changes.
A subsequent attach succeeds, fails, or receives altered service.

Most useful evidence: Mongo before/after export, WebUI/session logs, seed-script execution, authentication trace, change owner and ticket.

Path D — trusted signaling or packet-plane peer

A foothold obtains reachability on the Docker network.
It interacts with cleartext Diameter, PFCP, or GTP endpoints that rely heavily on network location and configured peer trust.
Session control, billing/policy state, or user-plane correlation changes.

Most useful evidence: peer identities and endpoints, session IDs/TEIDs, association events, error distributions, packet capture, route/firewall drift.

Path E — configuration integrity to RAN/control-plane outage

Repository or gateway access modifies PLMN/TAC/core/ZMQ fields.
UE/gNB starts successfully but attaches to the wrong endpoint or cannot complete registration/handover.
The event resembles RF or protocol failure unless configuration provenance is checked first.

Most useful evidence: signed config manifest, Git diff, process command line, resolved endpoint, gNB/AMF timestamps.

What this lab cannot substantiate

Salt Typhoon router exploitation, lawful-intercept mediation access, or carrier CDR collection.
Real inter-operator roaming via SEPP/N32; archived SEPP material is not an active topology.
SIGTRAN/SS7 carrier interconnect compromise.
Production OSS/BSS, DNS registrar, SMSC, IMS/VoLTE, eSIM SM-DP+, or call-center workflows.
Kubernetes/NFV MANO compromise or vendor RAN OAM/EMS access.
Physical baseband vulnerabilities through UERANSIM.

Those remain tabletop, log-schema, or future lab-expansion work. They must not be marked “tested” from Docker evidence.