Esri ArcGIS server 10.1 contains a blind SQL injection vulnerability

Overview

Esri’s ArcGIS server version 10.1 contains a blind SQL injection vulnerability that allows remote attackers to execute a subset of SQL commands via a query operation where clause.

Description

The Esri ArcGIS server version 10.1 contains a blind SQL injection vulnerability (CWE-89) for REST service queries. The where form field when constructing a query does not properly sanitize SQL commands from the input.

Proof-of-Concept:
http://<FQDN/IP>:6080/arcgis/rest/services/<SERVICE WITH QUERY SUPPORT>/query?f=json&where=featured%3Dtrue&returnGeometry=true&spatialRel=esriSpatialRelIntersects

---

Impact

A remote authenticated attacker may be able to run a subset of SQL commands against the back-end database.

---

Solution

Apply an Update

Esri released an update to ArcGIS Server 10.1 Service Pack 1. If you cannot patch, please consider the following workarounds.

---

Disable the query

The query operation may be disabled via ArcGIS Manager for each service.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent SQLi attacks since the attack comes as an SQL request from a legitimate user’s host. Restricting access would prevent an attacker from accessing a web interface using stolen credentials from a blocked network location.

---

Vendor Information

795644

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Environmental Systems Research Institute Inc Affected

Notified: September 25, 2012 Updated: November 07, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
Temporal	5.9	E:POC/RL:U/RC:C
Environmental	4.4	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

• <http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/1930&gt;
• <http://support.esri.com/en/knowledgebase/techarticles/detail/40665&gt;
• <http://www.esri.com/software/arcgis/arcgisserver&gt;
• <http://support.esri.com/en/downloads/patches-servicepacks&gt;
• <http://cwe.mitre.org/data/definitions/89.html&gt;

Acknowledgements

Thank you to the reporter that wishes to remain anonymous.

This document was written by Jared Allar.

Other Information

CVE IDs:	CVE-2012-4949
Date Public:	2012-10-29 Date First Published: