CVE-2024-51957 in ArcGIS Server
Summary
by MITRE • 03/03/2025
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/04/2025
The vulnerability identified as CVE-2024-51957 represents a stored cross-site scripting flaw within ArcGIS Server versions 10.9.1 through 11.3, constituting a significant security weakness that could be exploited by determined attackers. This vulnerability specifically affects the server's handling of user-generated content, particularly in scenarios where users with publisher privileges can create and store malicious links. The flaw exists in the server's input validation and output encoding mechanisms, which fail to properly sanitize user-supplied data before it is stored and subsequently rendered to other users. The vulnerability is classified under CWE-79 as a classic stored XSS vulnerability, where malicious scripts are stored on the server and executed when victims access the compromised content.
The technical exploitation of this vulnerability requires an attacker to possess publisher-level privileges within the ArcGIS Server environment, which establishes a high barrier to entry but does not eliminate the threat entirely. Attackers with these elevated permissions can craft malicious links containing JavaScript code that gets stored in the server's database or content management system. When other users with lower privileges click on these crafted links, the stored JavaScript executes within their browser context, potentially leading to session hijacking, credential theft, or other malicious activities. The attack vector is particularly concerning because it leverages the trust relationship between users and the server, making it difficult for end users to identify the malicious nature of the links they encounter.
The operational impact of this vulnerability extends beyond simple script execution, as it can compromise the integrity of the ArcGIS Server environment and potentially provide attackers with access to sensitive geospatial data and user information. While the confidentiality impact is rated as low, the potential for attackers to manipulate content and redirect users to malicious sites creates a significant risk to data integrity and user trust. The vulnerability does not affect system availability, but the ability to inject malicious code into the server's content repository could lead to broader security implications if attackers can escalate their privileges or use the compromised system as a foothold for further attacks. This aligns with ATT&CK technique T1566.001 for initial access through spearphishing attachments and T1059.001 for command and scripting interpreter execution.
Organizations using ArcGIS Server versions 10.9.1 through 11.3 should implement immediate mitigation strategies to address this vulnerability. The most effective approach involves applying the vendor-provided security patches and updates as soon as they become available. Additionally, administrators should enforce strict input validation and output encoding policies throughout the server configuration, ensuring that all user-generated content undergoes rigorous sanitization before being stored. Implementing content security policies and restricting publisher privileges to only essential personnel can significantly reduce the attack surface. Regular security audits and monitoring of user activities should be conducted to detect any suspicious content creation or modification attempts. Network segmentation and web application firewalls can provide additional layers of protection, while user education about recognizing potentially malicious links remains crucial for overall security posture improvement.