CVE-2024-51961: Esri ArcGIS Server Information Disclosure

CVE-2024-51961 Overview

CVE-2024-51961 is a local file inclusion (LFI) vulnerability in Esri ArcGIS Server versions 11.3 and below. A remote, unauthenticated attacker can craft a URL that causes the server to read internal files and disclose sensitive configuration data. The flaw maps to [CWE-73] (External Control of File Name or Path) and [CWE-610] (Externally Controlled Reference to a Resource in Another Sphere).

The vulnerability impacts confidentiality only. Integrity and availability remain unaffected. Esri has issued a security patch as part of the ArcGIS Server Security 2025 Update 1.

Critical Impact
Unauthenticated remote attackers can read sensitive internal files from vulnerable ArcGIS Server deployments, exposing configuration data that may enable follow-on attacks.

Affected Products

Esri ArcGIS Server 11.3
Esri ArcGIS Server versions below 11.3
Deployments without the ArcGIS Server Security 2025 Update 1 patch applied

Discovery Timeline

2025-03-03 - CVE-2024-51961 published to NVD
2025-04-10 - Last updated in NVD database

Technical Details for CVE-2024-51961

Vulnerability Analysis

The vulnerability allows an attacker to influence file path resolution on the ArcGIS Server. By crafting a request containing manipulated path parameters, the attacker forces the server to include or read files outside the intended scope. The server returns the contents of those files in its response.

Because the vulnerable endpoint does not require authentication, exploitation works against any internet-exposed ArcGIS Server instance running version 11.3 or earlier. The attack requires no user interaction and minimal complexity, which raises the practical risk for exposed production deployments.

The EPSS model assigns this vulnerability a probability of 0.434% (percentile 34.373), and no public exploit code has been catalogued at this time. Sensitive files commonly targeted in this class of attack include server configuration files, credentials stored in plaintext, internal service tokens, and deployment manifests.

Root Cause

The root cause is improper validation of user-supplied input used in file path construction. The application accepts externally controlled references and resolves them against the local filesystem without enforcing a strict allowlist or canonicalization check. This pattern is characteristic of [CWE-73] and [CWE-610] weaknesses.

Attack Vector

The attack vector is purely network-based. An attacker sends a single HTTP request containing a crafted URL parameter that references an internal file path. The ArcGIS Server processes the path, reads the targeted file, and returns its contents in the response body or error message. No credentials, prior session, or user interaction are required.

No verified proof-of-concept code is available in public repositories. Defenders should treat the vendor advisory as the authoritative source for technical specifics. See the Esri ArcGIS Server Security Patch advisory for additional detail.

Detection Methods for CVE-2024-51961

Indicators of Compromise

HTTP requests to ArcGIS Server endpoints containing path traversal sequences such as ../, encoded variants (%2e%2e%2f), or absolute filesystem paths in URL parameters
Unexpected outbound responses from ArcGIS Server containing configuration file content, credentials, or internal directory listings
Access log entries referencing sensitive filenames such as web.config, server.properties, or files under ArcGIS installation directories

Detection Strategies

Inspect web server and reverse proxy logs for ArcGIS Server URLs containing path manipulation characters or references to known sensitive files
Deploy web application firewall (WAF) rules that block path traversal patterns targeting ArcGIS REST API endpoints
Correlate anomalous response sizes from ArcGIS Server endpoints against established baselines to surface data exfiltration attempts

Monitoring Recommendations

Enable verbose HTTP access logging on ArcGIS Server and forward logs to a centralized analytics platform
Alert on repeated 200-status responses for parameters containing traversal sequences, especially from a single source IP
Monitor for scanning behavior across the ArcGIS REST /services and /admin endpoints from untrusted networks

How to Mitigate CVE-2024-51961

Immediate Actions Required

Apply the ArcGIS Server Security 2025 Update 1 patch from Esri to all ArcGIS Server 11.3 and earlier deployments
Inventory all internet-exposed ArcGIS Server instances and prioritize patching of externally accessible systems
Review historical access logs for evidence of prior exploitation attempts targeting file path parameters

Patch Information

Esri released the fix in the ArcGIS Server Security 2025 Update 1 Patch. Administrators should download and apply the patch as documented in the Esri ArcGIS Server Security Patch advisory. Verify the patched version after installation and restart the ArcGIS Server service to ensure the fix is active.

Workarounds

Restrict network access to ArcGIS Server administrative and REST endpoints using firewall rules or a reverse proxy allowlist
Deploy WAF signatures that block path traversal sequences and references to sensitive filesystem locations in URL parameters
Enforce least-privilege filesystem permissions on the ArcGIS Server service account to limit the scope of readable files
Place ArcGIS Server behind an authenticated gateway where business requirements permit

bash

# Example WAF rule pattern (ModSecurity) to block path traversal against ArcGIS endpoints
SecRule REQUEST_URI "@rx (?i)(\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f)" \
    "id:1005196,phase:1,deny,status:403,\
    msg:'Potential LFI attempt against ArcGIS Server (CVE-2024-51961)'"