CVE-2022-38203 : Security Advisory and Response

A vulnerability has been identified in ArcGIS Enterprise versions 10.8.1 and 10.7.1 that could potentially lead to Server-Side Request Forgery (SSRF) attacks. This could allow an attacker to forge requests to arbitrary URLs from the system, posing a significant security risk. Here's what you need to know about CVE-2022-38203:

Understanding CVE-2022-38203

ArcGIS Enterprise versions 10.8.1 and 10.7.1 are affected by a vulnerability that could be exploited by a remote, unauthenticated attacker to carry out SSRF attacks, potentially leading to network enumeration or reading from hosts inside the network perimeter.

What is CVE-2022-38203?

The allowedProxyHosts property in ArcGIS Enterprise versions 10.8.1 and 10.7.1 is not fully honored, which could be exploited by attackers to perform SSRF attacks. This vulnerability could allow unauthorized access to sensitive data and pose a serious security risk.

The Impact of CVE-2022-38203

The impact of CVE-2022-38203 is rated as HIGH according to the CVSS v3.1 base score of 7.5. This vulnerability could lead to unauthorized access to sensitive information, network enumeration, or reading from hosts within the network perimeter.

Technical Details of CVE-2022-38203

Here are the technical details of CVE-2022-38203:

Vulnerability Description

The vulnerability stems from the lack of full enforcement of the allowedProxyHosts property in ArcGIS Enterprise versions 10.8.1 and 10.7.1, which allows attackers to conduct SSRF attacks.

Affected Systems and Versions

The vulnerability affects Esri's Portal for ArcGIS versions 10.8.1 and 10.7.1 running on x64 platforms.

Exploitation Mechanism

The vulnerability could be exploited by a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter.

Mitigation and Prevention

To mitigate the risks associated with CVE-2022-38203, consider the following security measures:

Immediate Steps to Take

Apply the latest security patches provided by Esri for Portal for ArcGIS versions 10.8.1 and 10.7.1 to address the vulnerability.
Monitor network traffic for any suspicious activities that could indicate SSRF attacks.

Long-Term Security Practices

Regularly update and patch all software components to prevent vulnerabilities.
Implement network segmentation to restrict unauthorized access to sensitive systems.

Patching and Updates

Ensure that your ArcGIS Enterprise installations are up-to-date with the latest security patches from Esri to mitigate the risks associated with CVE-2022-38203.