...

Unpatched versions of Nolana and Orchid are vulnerable to critical security issues related to system users.  These users are provisioned by modules themselves and are used to perform internal module-to-module operations.  Credentials for these users are hardcoded in the source code.  This makes it trivial to authenticate as these users, allowing resulting in unauthorized access to potentially dangerous APIs, including those which allow configuration to be viewed and modified, the ability to viewallowing to view and modify configuration including single-sign-on configuration, to read, add and alter modify user data, and to read and transfer fees/fines on in a patron's account, and to read inventory data.

...

N.B. After changing SYSTEM_USER_PASSWORD or SYSTEM_USER_NAME it is NOT sufficient to only redeploy the module; you also MUST reinstall the module as show above.

N.B. Disabling an affected module is NOT sufficient to fix the vulnerability.

Am I a victim?

Unfortunately the Folio Security Team is unaware of a way to conclusively determine if these vulnerabilities have been exploited.  OKAPI does log the user ID for all proxied requests, so you may look for unusual activity associated with either of these users.  Depending on your hosting infrastructure, it may also be possible to look at load balancer and/or reverse proxy logs, but there may not be enough information logged there if request payloads/certain headers aren't captured.  The window of opportunity for attacks begins when you upgraded to Nolana.Another challenge is the volume of logs which need to be inspected. These vulnerabilities have been around for a long time (~2 years).