Any comments from IFS regarding this?

Yes, eagerly awaiting an update. I came across POC on Twitter which suggested WebLogic is vulnerable so we’ve locked things down until IFS provide an update.

Hi @Garak how have you gone about locking things down?

Thanks,

Mick.

We turned off all internet accessibility to our environments so they are only accessible on the corporate network directly. That way it’s impossible for the module to be called outside our network.

They are behind a reverse proxy and firewall etc. but obviously they are unlikely to help with this vuln.

By turning off internet access it means that we’ve lost the use of MWO and Aurena in the field for our maintenance team unless they’re on corporate wi-fi, and contractors now will have to use the terminal server.

This is all in addition to other network-wide mitigations too of course.

Please subscribe to this KBA which will be updated every 24 hours