CVE-2025-67708
📋 TL;DR
A stored cross-site scripting vulnerability in Esri ArcGIS Server allows attackers to upload malicious files that execute JavaScript in victims' browsers when accessed. This affects ArcGIS Server 11.4 and earlier versions on both Windows and Linux systems. Remote unauthenticated attackers can exploit this in certain configurations.
💻 Affected Systems
- Esri ArcGIS Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on client systems.
Likely Case
Session hijacking, credential theft, or defacement of web interfaces through malicious script execution.
If Mitigated
Limited impact with proper input validation, output encoding, and content security policies in place.
🎯 Exploit Status
Stored XSS typically has low exploitation complexity once the vulnerable endpoint is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply ArcGIS Server Security 2025 Update 2 Patch
Vendor Advisory: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-2-patch
Restart Required: Yes
Instructions:
1. Download the Security 2025 Update 2 patch from My Esri. 2. Stop ArcGIS Server services. 3. Apply the patch according to Esri documentation. 4. Restart ArcGIS Server services. 5. Verify the patch was applied successfully.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources
Add appropriate CSP headers to web server configuration
Restrict File Uploads
allLimit file upload capabilities to authenticated users only
Configure ArcGIS Server to require authentication for file upload endpoints
🧯 If You Can't Patch
- Implement web application firewall rules to block XSS payloads
- Disable or restrict access to file upload functionality in vulnerable configurations
🔍 How to Verify
Check if Vulnerable:
Check ArcGIS Server version and compare against affected versions (11.4 and earlier). Review configuration for vulnerable file upload settings.Check Version:
Check version in ArcGIS Server Administrator Directory at /arcgis/admin or via administration consoleVerify Fix Applied:
Verify patch installation through ArcGIS Server administration interface and test file upload functionality with XSS payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with script-like content
- Multiple failed upload attempts with suspicious filenames
Network Indicators:
- HTTP requests containing script tags or JavaScript in file upload parameters
SIEM Query:
source="arcgis" AND (http_method="POST" OR http_method="PUT") AND (uri_path contains "upload" OR uri_path contains "file") AND (http_content contains "<script>" OR http_content contains "javascript:")