Security issue - Oracle Identity System Administration login screen is exposed to public

Hi

You don't need the CLIENT_ACCEPTED event to look for the IP and the HTTP::URI command in the HTTP_REQUEST should start from / rather than include http:// etc.

So your code would look something like

when HTTP_REQUEST {
 
if { [string tolower [HTTP::uri]] starts_with "/sysadmin/faces/signin"}{
 
	if {not [IP::addr [IP::client_addr] equals 10.0.40.0/24]} {
		drop
		}
	}
}