An open directory on Avaya infrastructure

What I found

On 21 June 2025, I found directory indexing enabled on a public-facing system associated with Avaya. The page did not require a login. Opening it returned a browsable file tree.

The names and layout pointed to development work rather than files intended for public download. I could see references to internal tooling, cloud AI endpoints, backend structure, and development assets.

I did not download anything. The listing itself was enough to document the issue, so I recorded what was visible and moved to disclosure.

Why the listing mattered

A directory index can look harmless when none of the filenames contain an obvious secret. It still gives away useful context.

In this case, the exposed structure could have helped someone:

• map parts of the backend
• identify internal tools and scripts
• locate cloud-connected endpoints
• learn naming conventions used by the development team
• narrow down where to look for weaker API surfaces

I could not assess the contents without accessing the files, and I was not going to do that. My report stayed focused on the public listing and the information it disclosed.

Disclosure

• 21 June: sent the initial report to securityalerts@avaya.com
• 23 June: Avaya replied and asked me to encrypt the affected URL with their PGP key
• 23 June: sent the encrypted URL with the technical context
• 24 June: Avaya confirmed they could decrypt the report and did not need more information
• 26 June: Avaya confirmed the issue had been remediated

The exchange was short and practical. Their team gave me a safe channel for the sensitive detail, confirmed receipt, then closed the exposed listing within five days of my first email.

Recognition

Avaya does not pay bounties for this program. They offered to add me to their Security Hall of Fame, which I accepted.

Notes after the fix

The main fix is basic: disable directory indexing on public servers unless there is a deliberate reason to expose it. That check should cover forgotten staging hosts and old paths, not only the primary application.

For researchers, this was a good reminder to stop when the evidence is already sufficient. The directory page proved the exposure. Digging into the files would have added risk without making the report much stronger.