CVE-2021-29102
📋 TL;DR
This SSRF vulnerability in ArcGIS Server Manager allows unauthenticated remote attackers to make arbitrary GET requests from the vulnerable system. This can lead to internal network scanning, data exfiltration, or chaining with other vulnerabilities. Affects ArcGIS Server Manager versions 10.8.1 and earlier.
💻 Affected Systems
- ArcGIS Server Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains internal network access, exfiltrates sensitive data, or uses the vulnerable server as a proxy to attack other internal systems, potentially leading to full network compromise.
Likely Case
Internal network enumeration, scanning of internal services, and potential data leakage from internal endpoints accessible to the server.
If Mitigated
Limited impact due to network segmentation, egress filtering, and proper access controls preventing the server from reaching sensitive internal resources.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and tooling exists; no authentication required makes exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply Security 2021 Update 1 Patch
Vendor Advisory: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/
Restart Required: Yes
Instructions:
1. Download Security 2021 Update 1 patch from My Esri. 2. Stop ArcGIS Server services. 3. Apply the patch following Esri's installation guide. 4. Restart services.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from ArcGIS Server to only necessary destinations
Access Control
allImplement network ACLs to block external access to ArcGIS Server Manager if not required
🧯 If You Can't Patch
- Implement strict egress filtering to limit the server's outbound connections
- Place ArcGIS Server behind a WAF configured to detect and block SSRF patterns
🔍 How to Verify
Check if Vulnerable:
Check ArcGIS Server version; if 10.8.1 or earlier and Manager component is accessible, assume vulnerable.Check Version:
Check ArcGIS Server Administrator Directory at https://<server>:6443/arcgis/admin or review installation logs.Verify Fix Applied:
Verify patch installation via version check and test that SSRF attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from ArcGIS Server to internal IPs
- Multiple failed authentication attempts followed by external requests
Network Indicators:
- ArcGIS Server making unexpected HTTP requests to internal services
- Traffic patterns suggesting port scanning from the server
SIEM Query:
source="arcgis-server" AND (url="*://internal*" OR dest_ip=private_ip_range)