Infinera MTC-9 Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Infinera MTC-9 version R22.1.1.0275. This vulnerability allows remote unauthenticated users to access other network resources by sending HTTPS requests through the appliance, which is used as a bridge. The vulnerability exploits an endpoint exposed by the device's web server, enabling access to data from internal servers that are not reachable from external networks, all without any authorization.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal network resources and data, bypassing external network restrictions.