Pexip Infinity Missing Authentication Vulnerability in Internal API Allowing Cross-Node Impact

A vulnerability in Pexip Infinity versions prior to 39.0 allows for missing authentication in a critical internal API. This flaw enables an attacker, who already has the ability to execute code on one node within a Pexip Infinity installation, to affect the operation of other nodes in the installation.

Impact

Exploitation of this vulnerability could disrupt the normal operation of nodes within a Pexip Infinity installation, potentially leading to degraded performance or availability of services.

Remediation

Users are advised to upgrade to Pexip Infinity version 39.0. Ensure that only trusted users have access to operating system administration credentials and disable SSH across the Pexip Infinity platform, re-enabling it only when absolutely necessary.