CVE-2024-25699: Esri Portal For ArcGIS Auth Bypass Vulnerability

CVE-2024-25699 Overview

CVE-2024-25699 is an improper authentication vulnerability [CWE-287] in the Home application for Esri Portal for ArcGIS. The flaw affects Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes. A remote, authenticated attacker with low‑privileged access can cross an authentication and authorization boundary under specific circumstances. Successful exploitation results in a scope change and compromises confidentiality, integrity, and availability of the software.

Critical Impact
An authenticated low‑privileged attacker can escalate access beyond their assigned scope, gaining full compromise of Esri Portal for ArcGIS confidentiality, integrity, and availability.

Affected Products

Esri Portal for ArcGIS versions 11.2 and below (Windows and Linux)
Esri ArcGIS Enterprise versions 11.1 and below (Kubernetes)
Deployments running on Microsoft Windows and Linux platforms

Discovery Timeline

2024-04-04 - CVE-2024-25699 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25699

Vulnerability Analysis

The vulnerability resides in the Home application component of Esri Portal for ArcGIS. The Home application fails to consistently enforce authentication and authorization boundaries. An attacker who already holds a valid low‑privileged account can leverage unique conditions to cross those boundaries. The result is a scope change, meaning the impacted component grants access to resources outside the originally authenticated context.

Exploitation is rated difficult due to high attack complexity. The attacker must satisfy conditions outside their direct control before the flaw becomes reachable. Once triggered, however, the attacker gains high impact on confidentiality, integrity, and availability across the affected Portal instance.

Root Cause

The root cause is improper authentication [CWE-287] in the Home application's access control logic. Authorization checks do not correctly validate the acting principal against the requested scope. Because Portal for ArcGIS acts as the identity and content management layer for ArcGIS Enterprise, a scope change in this component elevates privileges into administrative territory.

Attack Vector

The attack is delivered over the network by an authenticated user holding low‑level portal credentials. No user interaction is required. Because the vulnerable component authorizes access to other portal resources, successful exploitation changes scope and affects components beyond the vulnerable one. Esri has not published exploitation details, and no public proof‑of‑concept exploit is available. Refer to the Esri Portal for ArcGIS Security 2024 Update 1 advisory for vendor technical details.

Detection Methods for CVE-2024-25699

Indicators of Compromise

Portal audit log entries showing a low‑privileged account accessing administrative endpoints or content outside its assigned groups.
Unexpected role assignments, sharing changes, or item ownership transfers initiated from non‑administrative accounts.
Successful REST API calls to /sharing/rest/portals/self/ administrative subroutes from accounts lacking the administrator role.

Detection Strategies

Baseline expected portal role and permission usage per account, then alert on API calls that deviate from that baseline.
Correlate Portal for ArcGIS authentication logs with subsequent privileged actions to identify scope‑change events.
Monitor for anomalous session behavior where a single token performs actions across multiple privilege boundaries.

Monitoring Recommendations

Ingest Portal for ArcGIS logs and reverse‑proxy access logs into a centralized SIEM for correlation.
Track failed and successful administrative operations by user, source IP, and user agent to detect account misuse.
Alert on creation of new administrator accounts or elevation of existing accounts outside change windows.

How to Mitigate CVE-2024-25699

Immediate Actions Required

Upgrade Portal for ArcGIS to a version above 11.2 on Windows and Linux, and ArcGIS Enterprise on Kubernetes to a version above 11.1.
Audit portal user accounts and remove or disable inactive, shared, or unnecessary low‑privileged accounts.
Rotate credentials for any account that showed anomalous activity prior to patching.

Patch Information

Esri released fixes as part of the Portal for ArcGIS Security 2024 Update 1. Administrators should apply the security patch or upgrade to a fixed release as documented in the Esri Portal for ArcGIS Security 2024 Update 1 advisory. Verify installed version through the Portal Administrator Directory before and after patching.

Workarounds

Restrict network access to the Portal for ArcGIS Home application to trusted networks using firewall or reverse‑proxy rules until patching is complete.
Enforce multi‑factor authentication on all portal accounts to raise the cost of credential‑based access.
Apply least‑privilege role assignments and remove custom roles that grant broader scope than required.

bash

# Verify installed Portal for ArcGIS version
curl -k "https://<portal-host>/arcgis/portaladmin/?f=json" \
  -H "Referer: https://<portal-host>" \
  --data "token=<admin-token>"