CVE-2025-67705
📋 TL;DR
A stored cross-site scripting vulnerability in Esri ArcGIS Server allows attackers to upload malicious files that execute JavaScript in victims' browsers when accessed. This affects ArcGIS Server 11.4 and earlier versions on both Windows and Linux operating systems.
💻 Affected Systems
- Esri ArcGIS Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on client systems.
Likely Case
Session hijacking, credential theft, or defacement of web applications using the vulnerable ArcGIS Server.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though the vulnerability still exists at the server level.
🎯 Exploit Status
Attack requires ability to upload files to the server, but no authentication is needed in vulnerable configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply Security 2025 Update 2 Patch
Vendor Advisory: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-2-patch
Restart Required: Yes
Instructions:
1. Download the Security 2025 Update 2 patch from Esri's support site. 2. Stop ArcGIS Server services. 3. Apply the patch according to Esri's installation instructions. 4. Restart ArcGIS Server services. 5. Verify the patch was successfully applied.
🔧 Temporary Workarounds
Disable File Upload Functionality
allRestrict or disable file upload capabilities in ArcGIS Server configurations to prevent exploitation.
Modify ArcGIS Server configuration files to remove or restrict upload endpoints
Implement Web Application Firewall Rules
allConfigure WAF to block malicious file uploads and XSS payloads.
Add WAF rules to detect and block suspicious file upload patterns and script tags
🧯 If You Can't Patch
- Implement strict input validation and output encoding for all user-supplied content
- Deploy network segmentation to isolate ArcGIS Server from internet access
🔍 How to Verify
Check if Vulnerable:
Check ArcGIS Server version and compare against affected versions (11.4 and earlier). Review configuration for file upload capabilities.Check Version:
Check ArcGIS Server Administrator Directory or management console for version informationVerify Fix Applied:
Verify that Security 2025 Update 2 patch is installed and test file upload functionality with XSS payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload activity
- Requests containing script tags or JavaScript in file uploads
- Access to uploaded files with suspicious extensions
Network Indicators:
- HTTP POST requests to file upload endpoints with malicious payloads
- Subsequent requests to uploaded malicious files
SIEM Query:
source="arcgis_server" AND (url="*upload*" OR method="POST") AND (content="<script>" OR content="javascript:")