CVE-2025-57870: Esri ArcGIS Server SQLi Vulnerability

CVE-2025-57870 Overview

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4, and 11.5 deployed on Windows, Linux, and Kubernetes platforms. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.

Critical Impact

Remote unauthenticated attackers can execute arbitrary SQL commands against the Enterprise Geodatabase, potentially leading to complete data compromise including unauthorized access, modification, or deletion of critical GIS data.

Affected Products

• Esri ArcGIS Server version 11.3
• Esri ArcGIS Server version 11.4
• Esri ArcGIS Server version 11.5

Discovery Timeline

• October 22, 2025 - CVE CVE-2025-57870 published to NVD
• October 31, 2025 - Last updated in NVD database

Technical Details for CVE-2025-57870

Vulnerability Analysis

This vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). The flaw exists within the ArcGIS Feature Service operation, where user-supplied input is not properly sanitized before being incorporated into SQL queries executed against the Enterprise Geodatabase.

The attack can be executed remotely over the network without requiring any authentication or user interaction. The scope of impact extends beyond the vulnerable component itself, affecting the confidentiality, integrity, and availability of the underlying database systems. An attacker exploiting this vulnerability can potentially read sensitive geospatial data, modify or corrupt database records, or delete critical information from the geodatabase.

Root Cause

The root cause of CVE-2025-57870 is insufficient input validation and sanitization in the ArcGIS Feature Service operation. When processing requests, the affected versions of ArcGIS Server fail to properly escape or parameterize user-supplied input before constructing SQL queries. This allows attackers to inject malicious SQL statements that are then executed with the privileges of the database connection used by the ArcGIS Server.

Attack Vector

The attack is network-based and targets the ArcGIS Feature Service endpoint. An unauthenticated remote attacker can craft malicious HTTP requests containing SQL injection payloads directed at specific Feature Service operations. When the vulnerable server processes these requests, the injected SQL commands are executed against the Enterprise Geodatabase.

The vulnerability mechanism involves manipulating input parameters within Feature Service requests. When these parameters are processed by the ArcGIS Server without proper sanitization, the malicious SQL statements bypass the intended query structure and execute arbitrary database commands. For detailed technical information, refer to the Esri Security Patch Announcement.

Detection Methods for CVE-2025-57870

Indicators of Compromise

• Unusual or malformed HTTP requests to ArcGIS Feature Service endpoints containing SQL syntax characters such as single quotes, semicolons, or UNION statements
• Unexpected database errors or exceptions in ArcGIS Server logs indicating SQL syntax violations
• Anomalous database queries in Enterprise Geodatabase audit logs, particularly queries attempting to access system tables or perform unauthorized data operations
• Unusual data access patterns or bulk data extraction from the geodatabase

Detection Strategies

• Deploy web application firewalls (WAF) with SQL injection detection rules to monitor and filter traffic to ArcGIS Server Feature Service endpoints
• Enable detailed logging on ArcGIS Server and configure log analysis to detect suspicious request patterns and SQL injection attempts
• Implement database activity monitoring on the Enterprise Geodatabase to identify unauthorized query execution or privilege escalation attempts
• Use SentinelOne Singularity to detect exploitation attempts through behavioral analysis and network traffic inspection

Monitoring Recommendations

• Monitor ArcGIS Server access logs for requests containing common SQL injection patterns such as ' OR '1'='1, UNION SELECT, or comment sequences like --
• Configure alerting for failed authentication attempts followed by successful Feature Service operations that may indicate injection-based authentication bypass
• Track database connection patterns and query execution times to identify potential data exfiltration activities

How to Mitigate CVE-2025-57870

Immediate Actions Required

• Apply the security patch released by Esri for affected ArcGIS Server versions immediately
• If immediate patching is not possible, restrict network access to ArcGIS Feature Service endpoints to trusted IP ranges only
• Review and audit Enterprise Geodatabase for any signs of unauthorized access or data modification
• Enable enhanced logging and monitoring on ArcGIS Server and database systems to detect potential exploitation attempts

Patch Information

Esri has released a security patch to address this SQL Injection vulnerability in ArcGIS Server Feature Services. Organizations running ArcGIS Server versions 11.3, 11.4, or 11.5 should apply the patch as soon as possible. The official security patch and detailed installation instructions are available in the Esri Security Patch Announcement.

Workarounds

• Implement network segmentation to restrict direct access to ArcGIS Server from untrusted networks
• Deploy a web application firewall with SQL injection protection rules in front of the ArcGIS Server
• Configure database-level access controls to limit the privileges of the ArcGIS Server database connection to the minimum required operations
• Disable or restrict access to Feature Service operations that are not essential for business operations until the patch can be applied

# Example: Restrict network access to ArcGIS Server using firewall rules
# Allow only trusted IP ranges to access Feature Service endpoints
iptables -A INPUT -p tcp --dport 6443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 6443 -j DROP