CVE-2024-8148: Esri Portal For ArcGIS Redirect Vulnerability

CVE-2024-8148 Overview

CVE-2024-8148 is an unvalidated redirect vulnerability in Esri Portal for ArcGIS versions 11.2 and below. A remote, unauthenticated attacker can craft a URL that redirects victims to arbitrary external websites. The flaw is classified under CWE-601: URL Redirection to Untrusted Site and primarily enables phishing campaigns that abuse the trusted Esri domain to increase credibility. Exploitation requires user interaction, typically by clicking a malicious link.

Critical Impact
Attackers can weaponize legitimate Esri Portal for ArcGIS URLs to redirect users to attacker-controlled sites, enabling credential harvesting and malware delivery through phishing.

Affected Products

Esri Portal for ArcGIS 10.8.1
Esri Portal for ArcGIS 10.9.1
Esri Portal for ArcGIS 11.1 and 11.2

Discovery Timeline

2024-10-04 - CVE-2024-8148 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8148

Vulnerability Analysis

The vulnerability resides in URL redirect handling within Esri Portal for ArcGIS. The application accepts a redirect target parameter from user-supplied input without validating that the destination belongs to an allow-listed domain. An attacker crafts a URL that appears to originate from the legitimate Portal for ArcGIS host but forwards the victim to an arbitrary external site.

Because the initial link points to a trusted Esri deployment, users and email security filters are more likely to trust it. This is a phishing amplifier rather than a direct code execution flaw. Impact is limited to confidentiality and integrity at low levels, and user interaction is required for exploitation.

Root Cause

The root cause is missing or insufficient validation of a redirect destination parameter processed by Portal for ArcGIS. The application trusts client-controlled input to determine the next navigation target and issues an HTTP redirect without confirming that the target host matches an approved list.

Attack Vector

An attacker constructs a URL pointing to a vulnerable Portal for ArcGIS endpoint that embeds an attacker-controlled destination in a redirect parameter. The attacker distributes this URL through email, messaging platforms, or malicious advertising. When a victim clicks the link, Portal for ArcGIS issues a redirect to the attacker's site, which typically mimics an Esri or corporate single sign-on login page to harvest credentials.

No authenticated code sample is required to describe the flaw. Refer to the Esri Portal for ArcGIS Security 2024 Update 2 advisory for vendor-specific technical detail.

Detection Methods for CVE-2024-8148

Indicators of Compromise

Inbound clicks on Portal for ArcGIS URLs containing suspicious redirect parameters such as url=, next=, returnUrl=, or redirect= pointing to external hosts.
HTTP 302 responses from Portal for ArcGIS whose Location header references domains outside the organization's approved list.
Referrer logs on external systems showing traffic originating from a corporate Portal for ArcGIS host but landing on unfamiliar domains.

Detection Strategies

Inspect web proxy and WAF logs for GET requests to Portal for ArcGIS with URL-encoded external domains in query parameters.
Correlate email gateway telemetry with clicks that traverse the Portal for ArcGIS host before terminating on newly registered or low-reputation domains.
Alert on Portal for ArcGIS access logs showing high-volume redirect responses to a small set of external destinations.

Monitoring Recommendations

Enable verbose access logging on Portal for ArcGIS and forward logs to a centralized analytics platform for continuous review.
Track user-reported phishing incidents that reference internal Esri URLs to identify active abuse campaigns.
Monitor DNS and proxy telemetry for outbound traffic patterns consistent with redirect-based phishing follow-through.

How to Mitigate CVE-2024-8148

Immediate Actions Required

Apply the Esri Portal for ArcGIS Security 2024 Update 2 patch to all affected deployments.
Inventory all Portal for ArcGIS instances at versions 10.8.1, 10.9.1, 11.1, and 11.2 and prioritize internet-facing systems.
Notify end users of active phishing risk associated with Portal for ArcGIS links until patching completes.

Patch Information

Esri released Portal for ArcGIS Security 2024 Update 2 to address CVE-2024-8148. Administrators should review the ESRI Portal for ArcGIS Security Update advisory for version-specific patch guidance and installation prerequisites.

Workarounds

Deploy a WAF rule that blocks or sanitizes redirect query parameters referencing external domains on Portal for ArcGIS endpoints.
Restrict Portal for ArcGIS exposure to trusted network segments or VPN users until the patch is applied.
Educate users to verify the final destination of any Portal for ArcGIS link before entering credentials, especially on login pages.

bash

# Example WAF rule (ModSecurity) to block external redirect parameters
SecRule ARGS:url|ARGS:redirect|ARGS:returnUrl|ARGS:next \
    "@rx ^https?://(?!portal\.example\.com)" \
    "id:1008148,phase:2,deny,status:403,\
    msg:'CVE-2024-8148 - Blocked external redirect in Portal for ArcGIS'"