CVE-2021-29108 : Security Advisory and Response

A privilege escalation vulnerability has been identified in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below, potentially allowing a remote attacker to impersonate another account through a SAML assertion attack.

Understanding CVE-2021-29108

This section will delve into the details of the CVE-2021-29108 vulnerability, its impact, technical insights, and mitigation strategies.

What is CVE-2021-29108?

CVE-2021-29108 is a privilege escalation vulnerability in Esri Portal for ArcGIS versions 10.9 and below. It allows a remote attacker to intercept and modify a SAML assertion, enabling them to impersonate another account through an XML Signature Wrapping Attack.

The Impact of CVE-2021-29108

The impact of this vulnerability is rated as high, with significant confidentiality, integrity, and availability impacts. Attackers with low privileges can exploit this vulnerability over the network without user interaction.

Technical Details of CVE-2021-29108

Let's explore the technical aspects of CVE-2021-29108, including vulnerability description, affected systems, and the exploitation mechanism.

Vulnerability Description

The vulnerability arises from improper verification of cryptographic signatures in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below, exposing them to XML Signature Wrapping attacks.

Affected Systems and Versions

Esri Portal for ArcGIS versions 10.9 and below are affected by this vulnerability, with version 10.9 being particularly susceptible to privilege escalation through SAML assertion manipulation.

Exploitation Mechanism

Attackers can exploit this vulnerability by intercepting and modifying SAML assertions to impersonate other accounts, leveraging the XML Signature Wrapping Attack strategy.

Mitigation and Prevention

In this section, we will discuss immediate steps to take, long-term security practices, and the importance of patching and updates.

Immediate Steps to Take

To mitigate the risk posed by CVE-2021-29108, always encrypt and sign SAML assertions. Implementing this best practice can prevent attackers from manipulating SAML assertions and impersonating accounts.

Long-Term Security Practices

Apart from immediate remediation, organizations should ensure that all SAML assertions are signed and encrypted as a long-term security measure to protect against similar vulnerabilities.

Patching and Updates

Esri has released a security update and strongly recommends applying the Portal for ArcGIS Security 2021 Update 1 Patch to address CVE-2021-29108 and enhance the security of the affected systems.