CVE-2024-38037: Esri Portal for ArcGIS Redirect Vulnerability

CVE-2024-38037 Overview

CVE-2024-38037 is an unvalidated redirect vulnerability affecting Esri Portal for ArcGIS versions 11.0 and below. A remote, unauthenticated attacker can craft a malicious URL that redirects victims to an arbitrary external website. The flaw simplifies phishing attacks by abusing the trust users place in the legitimate Esri Portal domain.

The vulnerability is classified under [CWE-601] (URL Redirection to Untrusted Site). Because the redirect originates from a trusted host, security controls that rely on domain reputation may fail to block the attack chain.

Critical Impact
Attackers can leverage the trusted Esri Portal domain to redirect users to attacker-controlled sites, enabling credential theft and malware delivery through convincing phishing lures.

Affected Products

Esri Portal for ArcGIS 10.9.1
Esri Portal for ArcGIS 11.0
All Esri Portal for ArcGIS versions 11.0 and below

Discovery Timeline

2024-10-04 - CVE-2024-38037 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38037

Vulnerability Analysis

The vulnerability resides in URL handling logic within Esri Portal for ArcGIS. The application accepts a user-controlled redirect target parameter without validating that the destination belongs to an allowlisted domain. An attacker constructs a URL pointing to the legitimate Portal for ArcGIS host but embeds an external destination in the redirect parameter.

When a victim clicks the link, the Portal issues an HTTP redirect to the attacker-specified location. The initial hostname displayed to the user belongs to the trusted organization, which increases click-through rates for phishing campaigns. Because the CWE-601 flaw requires user interaction and only affects a subset of confidentiality and integrity, it does not permit direct code execution or data extraction from the Portal itself.

Root Cause

The root cause is missing input validation on a redirect parameter within Portal for ArcGIS. The application does not compare the destination URL against an allowlist of trusted domains before issuing the HTTP 3xx response. This omission maps directly to [CWE-601] URL redirection to untrusted sites.

Attack Vector

Exploitation occurs over the network without authentication but requires user interaction. An attacker delivers the crafted URL through email, chat, or a compromised website. The victim clicks the link, which appears to point to the trusted ArcGIS Portal, and is silently redirected to an attacker-controlled destination hosting a phishing page or malware payload. See the Esri ArcGIS Security Update 2024 for vendor technical details.

Detection Methods for CVE-2024-38037

Indicators of Compromise

Outbound HTTP 302 or 301 responses from Portal for ArcGIS servers pointing to domains outside the organization's allowlist.
Web server access logs showing suspicious query parameters containing full URLs (http://, https://) or encoded variants (%2F%2F) in redirect parameters.
Phishing emails referencing ArcGIS Portal URLs that include unusual redirect or returnUrl query strings.

Detection Strategies

Inspect web proxy and Portal for ArcGIS logs for redirect parameters whose values do not match the organization's approved domains.
Correlate user reports of ArcGIS-branded phishing emails with access logs from the Portal to identify targeted campaigns.
Deploy signatures on email security gateways to flag messages containing ArcGIS Portal URLs with embedded external redirect targets.

Monitoring Recommendations

Enable verbose logging on Portal for ArcGIS web servers to capture full request URIs including query strings.
Forward Portal access logs to a centralized SIEM for retention and pattern analysis.
Alert on repeated redirect requests from a single source IP targeting the same victim account or session.

How to Mitigate CVE-2024-38037

Immediate Actions Required

Upgrade Esri Portal for ArcGIS to a version that includes the Portal for ArcGIS Security 2024 Update 2 patch.
Inventory all Portal for ArcGIS 10.9.1 and 11.0 deployments across the environment, including internet-facing instances.
Notify users about phishing campaigns that may impersonate ArcGIS Portal login pages.

Patch Information

Esri released a fix in the Portal for ArcGIS Security 2024 Update 2. Administrators should apply the update as documented in the Esri ArcGIS Security Update 2024 advisory. Verify installation by checking the Portal build number after applying the patch.

Workarounds

Restrict access to Portal for ArcGIS to authenticated internal users via network segmentation or VPN where operationally feasible.
Configure a reverse proxy or web application firewall to inspect redirect parameters and block requests whose destination values reference external hosts.
Deploy user awareness training emphasizing hover-to-inspect behavior on ArcGIS Portal links before clicking.

bash

# Example WAF rule concept: block requests where a redirect parameter
# points to an external host. Adapt to your WAF syntax and parameter names.
SecRule ARGS:redirect_uri "@rx ^https?://(?!portal\.example\.com)" \
    "id:1004001,phase:2,deny,log,status:403,\
    msg:'Blocked external redirect target on ArcGIS Portal (CVE-2024-38037)'"