CVE-2024-51946
📋 TL;DR
This stored XSS vulnerability in ArcGIS Server allows authenticated attackers with publisher privileges to inject malicious JavaScript into links. When victims click these crafted links, arbitrary code executes in their browsers. Only ArcGIS Server versions 11.3 and below are affected.
💻 Affected Systems
- ArcGIS Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated malicious publisher could steal session cookies, perform actions as authenticated users, or redirect to phishing sites when victims click malicious links.
Likely Case
Limited impact due to requiring publisher privileges - most likely session hijacking or credential theft from users who click malicious links.
If Mitigated
With proper access controls and user awareness, impact is minimal as it requires high-privilege authentication and user interaction.
🎯 Exploit Status
Exploitation requires authenticated publisher access and user interaction (clicking malicious link).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply Security 2025 Update 1 Patch
Vendor Advisory: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
Restart Required: Yes
Instructions:
1. Download Security 2025 Update 1 patch from Esri. 2. Stop ArcGIS Server services. 3. Apply the patch following Esri's installation guide. 4. Restart ArcGIS Server services. 5. Verify patch installation.
🔧 Temporary Workarounds
Restrict Publisher Access
allLimit publisher role assignments to trusted users only and implement principle of least privilege.
Content Security Policy
allImplement strict CSP headers to mitigate XSS impact by restricting script execution.
🧯 If You Can't Patch
- Implement strict access controls - only grant publisher privileges to absolutely necessary users
- Educate users about not clicking untrusted links within ArcGIS Server interface
🔍 How to Verify
Check if Vulnerable:
Check ArcGIS Server version via Administrator Directory at https://<server>:6443/arcgis/admin or using ArcGIS Server Manager interface.Check Version:
curl -k https://<server>:6443/arcgis/admin/system/properties | grep versionVerify Fix Applied:
Verify version is patched by checking build number or applying Security 2025 Update 1 patch confirmation.📡 Detection & Monitoring
Log Indicators:
- Unusual publisher account activity
- Multiple failed authentication attempts for publisher accounts
- Suspicious content creation/modification logs
Network Indicators:
- Unusual outbound connections from ArcGIS Server after link clicks
- Suspicious JavaScript payloads in HTTP requests
SIEM Query:
source="arcgis-server" AND (event_type="content_creation" OR event_type="content_modification") AND user_role="publisher" AND suspicious_patterns