CVE-2024-51954: Esri ArcGIS Server Auth Bypass Vulnerability

CVE-2024-51954 Overview

CVE-2024-51954 is an improper access control vulnerability [CWE-284] in Esri ArcGIS Server versions 11.3 and below on Windows and Linux. Under specific conditions, a remote, low-privileged authenticated attacker can access secure services published to a standalone (unfederated) ArcGIS Server instance. Successful exploitation grants unauthorized access to protected services outside the attacker's assigned authorization boundary, resulting in a scope change. The flaw yields high confidentiality impact and low integrity impact, with no effect on availability.

Critical Impact
A low-privileged authenticated user can reach secured services beyond their authorization boundary on standalone ArcGIS Server deployments, exposing protected geospatial data and services.

Affected Products

Esri ArcGIS Server versions 11.3 and below
ArcGIS Server on Microsoft Windows
ArcGIS Server on Linux

Discovery Timeline

2025-03-03 - CVE-2024-51954 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51954

Vulnerability Analysis

The vulnerability resides in the authorization logic of standalone (unfederated) ArcGIS Server deployments. Authenticated users with low privileges can invoke secure service endpoints that should require higher privileges. The condition produces a scope change because the authorization boundary of the calling identity is effectively bypassed at the service layer.

An attacker exploiting this weakness gains read access to geospatial datasets, map services, feature services, or geoprocessing services intended for other roles. Because ArcGIS Server frequently hosts sensitive location, infrastructure, and operational data, unauthorized disclosure can expose regulated information. The advisory notes limited integrity impact, indicating the attacker may also perform minor modifications through affected services.

Root Cause

The root cause is improper access control enforcement on secured services within standalone ArcGIS Server instances. The server does not consistently validate that an authenticated identity possesses the required authorization for the requested resource, allowing horizontal access across authorization boundaries. This class of flaw is categorized under [CWE-284: Improper Access Control].

Attack Vector

The attack is remote and network-based. The attacker must hold valid low-privilege credentials on the ArcGIS Server instance. No user interaction is required. The exploitation path involves issuing crafted requests to secured service endpoints on a standalone ArcGIS Server that is not federated with ArcGIS Enterprise Portal. Detailed exploitation mechanics are not published; refer to the Esri ArcGIS Server Security 2025 Update 1 Patch advisory for vendor guidance.

Detection Methods for CVE-2024-51954

Indicators of Compromise

Access log entries showing low-privileged user accounts requesting secured service endpoints outside their assigned role or group.
Repeated HTTP 200 responses to REST endpoints under /arcgis/rest/services/ that would normally return 403 Forbidden for the calling identity.
Unusual token generation activity from low-privileged accounts followed by access to services owned by administrators or other users.

Detection Strategies

Baseline authorized service access per user role and alert on deviations where identities access services outside their group membership.
Correlate ArcGIS Server token issuance with subsequent secured service requests to identify privilege boundary violations.
Review audit logs on standalone (unfederated) ArcGIS Server instances for cross-user service enumeration patterns.

Monitoring Recommendations

Forward ArcGIS Server logs to a centralized SIEM or data lake for correlation with identity and endpoint telemetry.
Track service-level authorization failures and unexpected successes tied to the same authenticated principal.
Monitor administrative and REST API endpoints (/arcgis/admin/, /arcgis/rest/services/) for enumeration behavior from non-administrative accounts.

How to Mitigate CVE-2024-51954

Immediate Actions Required

Apply the ArcGIS Server Security 2025 Update 1 Patch published by Esri to all affected standalone ArcGIS Server 11.3 and earlier deployments.
Inventory all standalone (unfederated) ArcGIS Server instances on Windows and Linux and prioritize patching for internet-facing systems.
Rotate credentials for low-privileged accounts if unauthorized service access is suspected, and review recent audit logs.

Patch Information

Esri released a fix in the ArcGIS Server Security 2025 Update 1 Patch. Administrators should download and install the appropriate patch for their version and platform following the Esri ArcGIS Server Security 2025 Update 1 Patch advisory.

Workarounds

Restrict network access to ArcGIS Server administrative and REST endpoints using firewall rules or reverse proxy access control lists.
Review and tighten role and group assignments so low-privileged accounts do not exist on servers hosting sensitive secured services.
Where feasible, federate ArcGIS Server with ArcGIS Enterprise Portal to centralize authorization enforcement, since the vulnerability affects standalone instances.

bash

# Verify installed ArcGIS Server version on Linux
/arcgis/server/tools/patchnotification/patchnotification -v

# Check patch status
/arcgis/server/tools/patchnotification/patchnotification -l