CVE-2025-57878 Overview
CVE-2025-57878 is an unvalidated redirect vulnerability in Esri Portal for ArcGIS versions 11.4 and below. A remote, unauthenticated attacker can craft a URL that redirects a victim to an arbitrary external website. The flaw is categorized under CWE-601: URL Redirection to Untrusted Site and simplifies phishing attacks by abusing the trusted Esri Portal domain.
Successful exploitation requires user interaction, typically clicking a crafted link. Because the initial domain in the URL belongs to a legitimate Portal for ArcGIS deployment, victims are less likely to detect the redirection to a malicious site.
Critical Impact
Attackers can weaponize the trusted Portal for ArcGIS domain to redirect users to attacker-controlled phishing pages, bypassing user vigilance and URL-based email filtering.
Affected Products
- Esri Portal for ArcGIS 10.9.1 (including Security 2025 Updates 1 and 2)
- Esri Portal for ArcGIS 11.0, 11.1, 11.2, 11.3
- Esri Portal for ArcGIS 11.4 (including Security 2025 Updates 1 and 2)
Discovery Timeline
- 2025-09-29 - CVE-2025-57878 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-57878
Vulnerability Analysis
The vulnerability stems from improper validation of a redirect parameter within Esri Portal for ArcGIS. The application accepts a user-supplied URL and forwards the browser to that destination without confirming the target belongs to a trusted origin. This is a classic open redirect pattern tracked as CWE-601.
Because the redirect endpoint resides on the Portal for ArcGIS server, the initial hostname in the crafted link is a legitimate, often internally trusted, resource. Users and secure email gateways that rely on domain reputation will treat the link as safe. The server then issues an HTTP redirect to the attacker-controlled destination.
The scope change reflected in the CVSS vector indicates the impact crosses a security boundary — a vulnerable Portal for ArcGIS instance is used to compromise the security posture of another site or user session.
Root Cause
The root cause is missing allow-list validation on a redirect target parameter. The application trusts client-supplied input as a redirect destination and does not restrict values to same-origin URLs or a pre-approved list of endpoints.
Attack Vector
An attacker constructs a URL pointing to the vulnerable Portal for ArcGIS instance with a redirect parameter set to an attacker-controlled site. The link is delivered through email, chat, or social media. When the victim clicks the link, the Portal server responds with an HTTP redirect that lands the browser on the phishing page. The attacker can then harvest credentials, deliver malware, or exploit browser-based follow-on attacks.
The vulnerability manifests in the Portal for ArcGIS redirect handling logic. See the Esri Portal for ArcGIS Security 2025 Update 3 Patch advisory for technical details.
Detection Methods for CVE-2025-57878
Indicators of Compromise
- HTTP requests to Portal for ArcGIS endpoints containing external URLs or encoded URLs in query parameters such as url, redirect, return, or next.
- Portal for ArcGIS access logs showing 302 or 301 responses with Location headers pointing to non-Esri, non-organizational domains.
- Referrer logs on internal services indicating traffic originating from Portal for ArcGIS redirects to unexpected external hosts.
Detection Strategies
- Inspect web server and reverse proxy logs for redirect parameters containing fully qualified external URLs or double-encoded schemes such as https%3A%2F%2F.
- Correlate email gateway telemetry with Portal for ArcGIS request logs to identify inbound links that abuse trusted internal domains.
- Deploy web application firewall (WAF) rules that flag Portal for ArcGIS URLs where redirect parameters resolve to domains outside a defined allow-list.
Monitoring Recommendations
- Continuously monitor Portal for ArcGIS versions across the environment and alert on hosts running 11.4 or earlier without the Security 2025 Update 3 patch.
- Track user reports of phishing links referencing internal Esri Portal hostnames and pivot on associated request paths and parameters.
- Enrich SIEM detections with DNS resolution of redirect destinations to flag newly registered or low-reputation domains.
How to Mitigate CVE-2025-57878
Immediate Actions Required
- Apply the Esri Portal for ArcGIS Security 2025 Update 3 patch to all Portal deployments running 10.9.1 through 11.4.
- Inventory all internal and internet-facing Portal for ArcGIS instances and prioritize patching those exposed to untrusted networks.
- Communicate the phishing risk to end users and instruct them to inspect the full destination URL after clicking Portal-hosted links.
Patch Information
Esri has published a fix in the Security 2025 Update 3 patch. Refer to the Esri Portal for ArcGIS Security 2025 Update 3 Patch advisory for downloads and installation guidance. Administrators should verify the patch version after installation and validate Portal functionality against a known baseline.
Workarounds
- Configure a reverse proxy or WAF in front of Portal for ArcGIS to strip or validate redirect parameters against an allow-list of trusted destinations.
- Restrict external access to Portal for ArcGIS to VPN or authenticated users while the patch is being rolled out.
- Educate users on inspecting the final URL bar after redirects and reporting suspicious Portal-hosted links to the security team.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
