CVE-2024-25702
📋 TL;DR
A stored cross-site scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites allows authenticated attackers with high privileges to inject malicious JavaScript into site configurations. When victims click crafted links, arbitrary code executes in their browsers, potentially disclosing privileged tokens. This affects versions 11.1 and below of the software.
💻 Affected Systems
- Esri Portal for ArcGIS Enterprise Sites
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full control of the Portal by stealing privileged tokens, leading to complete system compromise and data exfiltration.
Likely Case
Attacker steals session tokens or credentials from authenticated users, enabling unauthorized access to sensitive portal data and functions.
If Mitigated
Attack limited to authenticated high-privilege users only, with minimal impact if proper input validation and output encoding are implemented.
🎯 Exploit Status
Exploitation requires authenticated access with high privileges, making it less accessible to external attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply Security 2024 Update 2 or later
Vendor Advisory: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
Restart Required: Yes
Instructions:
1. Download Security 2024 Update 2 from Esri's official site.
2. Apply the update following Esri's deployment documentation.
3. Restart the Portal services as required.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and output encoding for all user-controllable fields in site configurations.
🧯 If You Can't Patch
- Restrict high-privilege user accounts to trusted personnel only.
- Implement web application firewall (WAF) rules to block XSS payloads.
🔍 How to Verify
Check if Vulnerable:
Check the Portal version in the administrative interface; if it's 11.1 or below, it is vulnerable.Check Version:
Check the version in the Portal's administrative dashboard or via Esri's version checking tools.Verify Fix Applied:
Verify the Portal version is updated to a version after Security 2024 Update 2 and test for XSS in site configuration fields.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to site configurations by high-privilege users.
- JavaScript payloads in configuration logs.
Network Indicators:
- HTTP requests containing suspicious script tags or JavaScript in site configuration parameters.
SIEM Query:
source="portal_logs" AND (event="config_modification" AND user_privilege="high") AND (payload CONTAINS "<script>" OR payload CONTAINS "javascript:")