CVE-2025-57873: Esri Portal For ArcGIS XSS Vulnerability

CVE-2025-57873 Overview

CVE-2025-57873 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in Esri Portal for ArcGIS versions 11.4 and below. A remote authenticated attacker with administrative privileges can supply a crafted string that triggers execution of arbitrary JavaScript in the victim's browser. Esri addressed the issue in the Portal for ArcGIS Security 2025 Update 3 patch. The flaw carries a CVSS 3.1 base score of 4.8 and requires both high privileges and user interaction, which limits practical exploitation to scenarios involving administrative account compromise or insider misuse.

Critical Impact
Successful exploitation executes attacker-supplied JavaScript in the browser context of a Portal for ArcGIS user, enabling session abuse, UI manipulation, and data exposure within the portal.

Affected Products

Esri Portal for ArcGIS 10.9.1 (including Security 2025 Update 1 and Update 2)
Esri Portal for ArcGIS 11.0, 11.1, 11.2, 11.3 (including Security 2024 and 2025 updates)
Esri Portal for ArcGIS 11.4 (including Security 2025 Update 1 and Update 2)

Discovery Timeline

2025-09-29 - CVE-2025-57873 published to the National Vulnerability Database
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2025-57873

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the Esri Portal for ArcGIS web interface. Portal for ArcGIS reflects attacker-supplied input back into a response without sufficient output encoding or input sanitization. When a target user loads a crafted URL or submits a crafted request, the browser interprets the injected payload as executable JavaScript.

Exploitation requires an authenticated session with administrative access, and the victim must interact with the malicious payload. The scope change in the CVSS vector indicates the executed script can affect resources beyond the vulnerable component, such as other portal content or user data rendered in the same browser context.

Impact includes session token theft, forced administrative actions through the portal API, defacement of portal pages, and exfiltration of mapping data or user information available to the targeted session.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. One or more portal endpoints echo request-controlled data into HTML responses without context-appropriate encoding. Esri's Security 2025 Update 3 patch addresses the sanitization gap in affected request handlers.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker with administrative access crafts a URL or form submission containing a JavaScript payload in a reflected parameter. The attacker delivers the link to another portal user, often another administrator, through phishing or an internal messaging channel. When the target clicks the link while authenticated, the payload executes in their browser under the portal's origin.

Because the precondition is administrative privilege, likely abuse scenarios involve a malicious insider, a compromised administrator account, or lateral movement following initial access. See the ESRI Security Patch Announcement for vendor technical details.

Detection Methods for CVE-2025-57873

Indicators of Compromise

Portal for ArcGIS web server access logs containing request parameters with HTML or JavaScript tokens such as <script, onerror=, javascript:, or encoded equivalents like %3Cscript.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after loading portal URLs.
Portal audit log entries showing administrative API actions originating from a browser session immediately after the user clicked an external link.

Detection Strategies

Inspect Portal for ArcGIS and reverse proxy access logs for URL parameters containing script tags, event handlers, or URL-encoded XSS payload patterns.
Correlate administrator authentication events with subsequent sensitive portal API calls to surface sessions acting on behalf of a browser-executed payload.
Deploy a web application firewall (WAF) rule set, such as OWASP Core Rule Set, in front of the portal to flag and log reflected XSS payload signatures.

Monitoring Recommendations

Monitor administrator account activity for anomalous portal content changes, item sharing modifications, or user role assignments.
Enable browser Content Security Policy (CSP) reporting on the portal to collect violations that may indicate XSS attempts in the wild.
Alert on repeated 4xx or 5xx responses to administrator sessions containing suspicious query strings, which may indicate probing.

How to Mitigate CVE-2025-57873

Immediate Actions Required

Apply the Portal for ArcGIS Security 2025 Update 3 patch to all deployments running version 11.4 or earlier.
Audit the list of accounts holding administrative privileges in the portal and remove any that are not strictly required.
Enforce multi-factor authentication for all administrator accounts to reduce the likelihood of account compromise feeding this attack path.

Patch Information

Esri released the Portal for ArcGIS Security 2025 Update 3 patch to remediate CVE-2025-57873. Installation instructions and version coverage are available in the ESRI Security Patch Announcement. Administrators should validate patch application against each affected version in their environment, including 10.9.1, 11.0, 11.1, 11.2, 11.3, and 11.4.

Workarounds

Restrict administrative access to the portal to a dedicated management network or VPN until the patch is applied.
Deploy a WAF policy in front of the portal that blocks requests containing common reflected XSS payload patterns.
Train administrators to avoid clicking portal URLs received from untrusted sources and to use isolated browser profiles for portal administration.

bash

# Example WAF rule concept (ModSecurity) to flag reflected script payloads
SecRule ARGS "@rx (?i)(<script|onerror=|javascript:|%3Cscript)" \
    "id:1057873,phase:2,deny,log,status:403,\
    msg:'Potential reflected XSS targeting Portal for ArcGIS (CVE-2025-57873)'"