CVE-2021-29103 : Security Advisory and Response

A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker to execute arbitrary JavaScript code in the user’s browser through a crafted link.

Understanding CVE-2021-29103

This CVE involves a reflected Cross Site Scripting (XSS) vulnerability present in Esri ArcGIS Server versions 10.8.1 and below.

What is CVE-2021-29103?

The CVE-2021-29103 vulnerability is a reflected Cross Site Scripting (XXS) issue that can be exploited by a remote attacker to inject and execute malicious JavaScript code in the victim's browser.

The Impact of CVE-2021-29103

With a CVSS base score of 6.1 (Medium Severity), this vulnerability could lead to unauthorized execution of code in the context of the user's browser, potentially exposing sensitive information or compromising the system.

Technical Details of CVE-2021-29103

This section provides insights into the vulnerability description, affected systems and versions, as well as the exploitation mechanism.

Vulnerability Description

The vulnerability exists in ArcGIS Server 10.8.1 and prior versions, allowing attackers to craft malicious links that, when clicked by users, can trigger the execution of arbitrary JavaScript code in their browsers.

Affected Systems and Versions

Affected Platforms: x64
Affected Product: ArcGIS Server
Affected Vendor: Esri
Vulnerable Versions: All versions less than 10.9

Exploitation Mechanism

The attacker needs to persuade a user to click on a specially crafted link, leading to the execution of unauthorized JavaScript code in the victim's browser.

Mitigation and Prevention

To secure systems against CVE-2021-29103, immediate actions and long-term security practices need to be considered along with applying relevant patches and updates.

Immediate Steps to Take

Educate users about suspicious links and enhance awareness regarding potential risks.
Implement filters or security mechanisms to detect and block malicious scripts.

Long-Term Security Practices

Regularly update ArcGIS Server to the latest version to prevent known vulnerabilities.
Follow secure coding practices to mitigate risks associated with Cross Site Scripting (XSS) attacks.

Patching and Updates

Esri has released a security update patch for ArcGIS Server to address CVE-2021-29103. Ensure timely application of this patch to mitigate the vulnerability.