CVE-2021-29114
📋 TL;DR
A critical SQL injection vulnerability in Esri ArcGIS Server feature services allows remote unauthenticated attackers to execute arbitrary SQL commands. This can lead to data theft, data manipulation, or service disruption. Organizations running ArcGIS Server 10.9 or earlier are affected.
💻 Affected Systems
- Esri ArcGIS Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the database backend, including data exfiltration, data destruction, and potential lateral movement to other systems.
Likely Case
Unauthorized data access and manipulation of GIS feature data, potentially leading to data integrity issues and service disruption.
If Mitigated
Limited impact with proper network segmentation and database permissions, though service availability could still be affected.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited; unauthenticated access makes this particularly dangerous.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply Security 2021 Update 2 patch
Vendor Advisory: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available
Restart Required: Yes
Instructions:
1. Download Security 2021 Update 2 patch from Esri. 2. Stop ArcGIS Server services. 3. Apply the patch according to Esri documentation. 4. Restart services and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to ArcGIS Server to trusted networks only
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor for suspicious SQL queries in database and application logs
🔍 How to Verify
Check if Vulnerable:
Check ArcGIS Server version; if 10.9 or earlier, assume vulnerable unless patched.Check Version:
Check via ArcGIS Server Administrator Directory REST endpoint or installation logsVerify Fix Applied:
Verify patch installation via ArcGIS Server Administrator Directory or version check.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed feature service requests with SQL-like patterns
Network Indicators:
- Unusual traffic patterns to feature service endpoints
- SQL error messages in HTTP responses
SIEM Query:
source="arcgis_logs" AND ("SQL" OR "syntax" OR "injection")