CVE-2025-57872: Esri Portal For ArcGIS Redirect Flaw

CVE-2025-57872 Overview

CVE-2025-57872 is an unvalidated redirect vulnerability affecting Esri Portal for ArcGIS version 11.4 and earlier. A remote, unauthenticated attacker can craft a URL that redirects a victim from a trusted Esri Portal domain to an arbitrary external site. The flaw is classified under CWE-601: URL Redirection to Untrusted Site and is primarily leveraged to strengthen phishing campaigns by abusing the trust users place in the Portal hostname. Exploitation requires user interaction, typically through a crafted link delivered by email, chat, or a compromised web page.

Critical Impact
Attackers can weaponize legitimate Esri Portal for ArcGIS URLs to redirect victims to attacker-controlled sites for credential harvesting or malware delivery.

Affected Products

Esri Portal for ArcGIS 10.9.1 (including Security 2025 Update 1 and Update 2)
Esri Portal for ArcGIS 11.0, 11.1, 11.2, 11.3 (including all listed Security Updates)
Esri Portal for ArcGIS 11.4 (including Security 2025 Update 1 and Update 2)

Discovery Timeline

2025-09-29 - CVE-2025-57872 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57872

Vulnerability Analysis

The vulnerability resides in URL handling logic within Esri Portal for ArcGIS. A parameter used to construct a redirect target is not validated against an allowlist of trusted destinations. An attacker supplies an external URL through this parameter, and the Portal issues an HTTP redirect to that location. Because the initial hostname belongs to a legitimate Esri Portal deployment, users and security tools are more likely to trust the link.

The attack changes the scope beyond the vulnerable component, since the redirect can carry the victim from a trusted origin to any attacker-controlled domain. Confidentiality and integrity impact are limited to the phishing outcome, as no direct data on the Portal itself is disclosed or modified by the redirect. Availability is not affected.

Root Cause

The root cause is missing or insufficient validation of user-controlled input used to determine a redirect destination. The affected endpoint accepts a fully qualified external URL where only relative paths or an allowlisted set of hosts should be permitted. Without host validation or output encoding checks, the server returns a Location header pointing to the attacker's domain.

Attack Vector

Exploitation is network-based and requires no authentication. The attacker crafts a URL of the form https://<trusted-portal>/path?redirect=https://attacker.example and delivers it to a victim. When the victim clicks the link, Portal for ArcGIS issues a redirect to the attacker's site, which typically hosts a cloned Esri login page or malware payload. The technique bypasses users' visual URL inspection since the initial hostname is legitimate.

No public proof-of-concept or exploit code is currently available for CVE-2025-57872. See the Esri ArcGIS Security Patch advisory for vendor guidance.

Detection Methods for CVE-2025-57872

Indicators of Compromise

Web server or proxy logs showing outbound HTTP 3xx responses from Portal for ArcGIS with Location headers pointing to external, non-Esri domains.
Inbound requests to Portal endpoints containing URL parameters with fully qualified external URLs (for example redirect=, url=, next=, returnUrl=).
User reports of Esri-branded login pages hosted on unfamiliar domains reached via a link that began with a trusted Portal hostname.

Detection Strategies

Parse Portal for ArcGIS access logs for query strings containing http:// or https:// values in redirect-related parameters.
Correlate HTTP 302/303 responses from Portal hosts with the Location header value and alert when the target host is outside the organization's allowlist.
Deploy web proxy or secure email gateway rules that flag URLs where the query string embeds a second, external URL.

Monitoring Recommendations

Ingest Portal for ArcGIS web server logs into a centralized SIEM for query-string and redirect analysis.
Monitor user-reported phishing submissions for links whose initial hostname matches internal Portal deployments.
Track failed authentication anomalies following any redirect events to identify potential credential-harvesting activity.

How to Mitigate CVE-2025-57872

Immediate Actions Required

Apply the Portal for ArcGIS Security 2025 Update 3 patch to all affected versions as documented by Esri.
Inventory all Portal for ArcGIS deployments and confirm patch level against the affected version list above.
Notify users of the phishing risk and reinforce guidance to inspect the final destination of any Portal-hosted link before submitting credentials.

Patch Information

Esri has released the Portal for ArcGIS Security 2025 Update 3 patch that addresses CVE-2025-57872. Details, downloads, and installation instructions are available in the Esri ArcGIS Security Patch advisory. Administrators should validate patch application in a staging environment before deploying to production Portals.

Workarounds

Configure an upstream reverse proxy or web application firewall (WAF) rule to strip or reject request parameters containing external URLs in redirect fields.
Restrict Portal for ArcGIS access to authenticated internal users through network segmentation until the patch is applied.
Enable browser and email gateway URL rewriting so users see the true final destination of any redirect chain originating from Portal hosts.

bash

# Example WAF rule (ModSecurity) to block external redirects in common parameters
SecRule ARGS:redirect|ARGS:url|ARGS:next|ARGS:returnUrl "@rx ^https?://(?!portal\.example\.com)" \
    "id:1005701,phase:2,deny,status:403,log,msg:'Blocked external redirect attempt (CVE-2025-57872)'"