Comment by ButlerianJihad
3 hours ago
MPTCP is a protocol extension that requires cooperation by both peers and all middleboxes. So, if there is a Layer 7 firewall, or DPI/SPI, or TLS termination on the path, and it's not inclined to preserve the MPTCP options, then MPTCP will be disabled.
Firewalls do not operate at layer 7 nor do TLS termination.
What you’re thinking of is load balancers. Most of them will do TLS termination. But there’s also plenty of load balancing solutions out there that will forward the raw TCP traffic (AWS NLB, DNS based solutions, and so forth).
But it’s also worth noting that this vulnerability doesn’t explicitly need MPTCP. Just the POC exploit uses that.