CVE-2025-57877: Esri Portal For ArcGIS XSS Vulnerability

CVE-2025-57877 Overview

CVE-2025-57877 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] affecting Esri Portal for ArcGIS versions 11.4 and below. A remote authenticated attacker holding administrative privileges can supply a crafted string that executes arbitrary JavaScript in a victim's browser session. The flaw carries a scope change, meaning executed script can affect resources beyond the vulnerable component. Esri published a fix in the Portal for ArcGIS Security 2025 Update 3 patch.

Critical Impact
An authenticated administrator can craft a URL that, when opened by another user, executes arbitrary JavaScript in the browser context of Esri Portal for ArcGIS, enabling session data theft, portal defacement, and cross-origin impact through the scope change.

Affected Products

Esri Portal for ArcGIS 10.9.1 (including Security 2025 Update 1 and Update 2)
Esri Portal for ArcGIS 11.0, 11.1, 11.2, and 11.3 (including their Security 2024 and 2025 updates)
Esri Portal for ArcGIS 11.4 (including Security 2025 Update 1 and Update 2)

Discovery Timeline

2025-09-29 - CVE-2025-57877 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57877

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the web interface of Esri Portal for ArcGIS. User-controlled input supplied by an authenticated administrator is reflected back into a rendered response without adequate output encoding or contextual sanitization. When a targeted user loads the crafted URL, the browser parses the injected payload as executable JavaScript within the origin of the ArcGIS portal.

Exploitation requires both administrative authentication and user interaction, which limits mass exploitation. However, the scope-change property allows the injected script to reach content and privileges outside the vulnerable component's security boundary. Consequences include hijacking of authenticated portal sessions, theft of tokens accessible to the browser, modification of portal content visible to other users, and pivoting into linked ArcGIS services.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Input passed to a portal endpoint is included in the HTTP response without HTML- or JavaScript-context encoding, allowing script tags or event handlers embedded in the request parameters to be interpreted by the browser.

Attack Vector

The attack vector is network-based over HTTPS. An attacker with administrator credentials constructs a URL containing a JavaScript payload in a vulnerable parameter, then delivers that URL to a targeted portal user through phishing, chat, or a shared resource. When the recipient clicks the link while authenticated to the portal, the payload executes in their browser under the portal origin.

No verified public proof-of-concept has been released. The vulnerability mechanism is standard reflected XSS; refer to the Esri Security Patch Update for vendor-supplied details.

Detection Methods for CVE-2025-57877

Indicators of Compromise

HTTP request logs to Esri Portal for ArcGIS containing URL-encoded <script>, onerror=, onload=, or javascript: sequences in query parameters.
Unexpected outbound requests from browsers immediately after loading portal URLs, indicating token or cookie exfiltration.
Portal audit events showing unusual configuration or content changes originating from administrator-linked sessions.

Detection Strategies

Inspect web server and reverse-proxy logs for reflected-XSS payload signatures targeting Portal for ArcGIS endpoints.
Deploy a Content Security Policy (CSP) in report-only mode to surface script injection attempts against the portal origin.
Correlate administrator account activity with the generation of unusual shared URLs sent through email or collaboration tools.

Monitoring Recommendations

Alert on HTTP 200 responses that echo request parameters containing HTML or JavaScript syntax to the ArcGIS portal.
Monitor portal administrator sessions for anomalous access patterns, geolocation changes, and off-hours activity.
Track browser console errors and CSP violation reports from users interacting with the portal.

How to Mitigate CVE-2025-57877

Immediate Actions Required

Apply the Portal for ArcGIS Security 2025 Update 3 patch to all affected deployments as documented by Esri.
Restrict administrator access to trusted networks and enforce phishing-resistant multi-factor authentication for privileged accounts.
Audit recently created portal content and shared URLs for indicators of crafted XSS links.

Patch Information

Esri released the Portal for ArcGIS Security 2025 Update 3 patch addressing CVE-2025-57877. Installation instructions and download links are available in the Esri Security Patch Update advisory. Administrators running versions 10.9.1 through 11.4 must apply the corresponding update for their release.

Workarounds

Limit portal administrator accounts to the minimum set of users required and remove standing administrative privileges where possible.
Enforce a strict Content Security Policy on the portal that blocks inline script execution and untrusted external script sources.
Educate administrators and portal users to avoid clicking portal URLs received from untrusted sources until the patch is applied.

bash

# Example Content-Security-Policy header for the reverse proxy fronting Portal for ArcGIS
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report" always;