CVE-2024-51962: Esri ArcGIS Server SQLi Vulnerability

CVE-2024-51962 Overview

CVE-2024-51962 is a SQL injection vulnerability in Esri ArcGIS Server. The flaw resides in the EDIT operation, which allows an authenticated user to modify column properties in a way that permits injection of arbitrary SQL statements. Exploitation requires elevated, non-administrative permissions specific to the application. A remote authenticated attacker can leverage this weakness to compromise data confidentiality and integrity across the affected service. The vulnerability is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Successful exploitation allows a privileged remote user to execute arbitrary SQL against the ArcGIS Server database, exposing or modifying data beyond the vulnerable component's security scope.

Affected Products

Esri ArcGIS Server (versions prior to the 2025 Update 1 security patch)
Deployments exposing feature service EDIT operations to authenticated users
ArcGIS Server instances backed by enterprise geodatabases

Discovery Timeline

2025-03-03 - CVE-2024-51962 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51962

Vulnerability Analysis

The vulnerability affects the EDIT operation exposed by ArcGIS Server feature services. When a privileged user modifies column properties, unsanitized input is incorporated into a SQL statement executed by the backend geodatabase. This lack of parameterization or input validation allows an attacker to alter the intended query structure.

Esri restricts the affected functionality to accounts with advanced, application-specific permissions. However, once those permissions are held, the attacker can perform actions well outside the intended scope of the EDIT operation. The scope change reflects that injected SQL executes in the database backend, which is a security authority distinct from the ArcGIS Server application layer.

Successful exploitation impacts confidentiality and integrity. An attacker can read sensitive rows from geodatabase tables, tamper with feature layer data, or alter records used by downstream mapping and analytics workflows. Availability is not affected according to the vendor analysis.

Root Cause

The root cause is improper neutralization of special SQL characters in column property parameters processed during EDIT operations. The backend concatenates attacker-controlled values into dynamic SQL rather than binding them as parameters, enabling statement modification.

Attack Vector

The attack is delivered over the network against the ArcGIS Server REST endpoint. The attacker must first authenticate and hold elevated permissions on a feature service that permits EDIT operations. They then submit a crafted request that alters column properties, embedding SQL fragments that the geodatabase interprets and executes. No user interaction is required.

The vulnerability manifests when the EDIT operation processes column property fields. See the Esri ArcGIS Server Security 2025 Update 1 Patch advisory for the vendor's technical description and affected version list.

Detection Methods for CVE-2024-51962

Indicators of Compromise

Unexpected EDIT operation requests to /rest/services/*/FeatureServer/* endpoints containing SQL metacharacters such as single quotes, semicolons, or comment sequences (--, /*).
Geodatabase audit log entries showing DDL or DML statements originating from the ArcGIS Server service account outside normal maintenance windows.
Successful authenticated sessions from unusual source IPs immediately followed by column property modification calls.

Detection Strategies

Inspect ArcGIS Server HTTP request logs for EDIT operations that include SQL keywords (UNION, SELECT, INSERT, DROP) inside column property parameters.
Correlate authentication events for privileged publisher and administrator accounts with subsequent feature service modification activity.
Enable and review geodatabase query logging to identify statements that do not match the ArcGIS Server ORM's expected query patterns.

Monitoring Recommendations

Forward ArcGIS Server access logs and geodatabase audit trails to a centralized SIEM for cross-source correlation.
Alert on any user account whose permission set includes advanced feature service editing to detect anomalous EDIT frequency or volume.
Baseline normal EDIT payload sizes and content; flag requests that deviate significantly from that baseline.

How to Mitigate CVE-2024-51962

Immediate Actions Required

Apply the ArcGIS Server Security 2025 Update 1 patch published by Esri to all affected servers.
Audit privileged accounts and revoke advanced editing permissions from users who do not require them.
Rotate credentials for any account with elevated ArcGIS Server permissions if compromise is suspected.

Patch Information

Esri released the fix in the ArcGIS Server Security 2025 Update 1 Patch. Administrators should follow the installation instructions in the Esri ArcGIS Server Security 2025 Update 1 Patch advisory, which lists supported versions and post-installation validation steps.

Workarounds

Restrict EDIT operation permissions on feature services to a minimal set of trusted service accounts until the patch is applied.
Place a web application firewall in front of ArcGIS Server REST endpoints and block requests containing SQL metacharacters in column property fields.
Disable public exposure of feature services that accept EDIT operations where business requirements permit.

bash

# Example: restrict access to the ArcGIS Server admin and REST endpoints at the reverse proxy
# Only allow authenticated internal ranges to reach EDIT-capable feature services
location ~ ^/arcgis/rest/services/.+/FeatureServer/.+/(applyEdits|addFeatures|updateFeatures|deleteFeatures) {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass https://arcgis-backend;
}