{ "file_item": { "filepath": "security-advisories", "filename": "CERT-EU-SA2021-072.pdf" }, "title": "ArcGIS Critical Vulnerability", "serial_number": "2021-072", "publish_date": "16-12-2021 19:20:00", "description": "On December 16th, Esri updated its blog post related to CVE-2021-44228 affecting ArcGIS products, especially ArcGIS Enterprise and ArcGIS Server. While this CVE affects the Java logging library \"log4j\", all products using this library are vulnerable to Unauthenticated Remote Code Execution.
ArcGIS Enterprise components contain the vulnerable log4j library. However, Esri specifies in its blog post that there is no known exploit available for any version of a base ArcGIS Enterprise deployment or stand-alone ArcGIS Server at this time. Still, ESRI released a Log4Shell mitigation scripts that fully address CVE-2021-44228.", "url_title": "2021-072", "content_markdown": "---\ntitle: 'ArcGIS Critical\u00a0Vulnerability'\nversion: '1.0'\nnumber: '2021-072'\ndate: 'December 16, 2021'\n---\n\n_History:_\n\n* _16/12/2021 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn December 16th, Esri updated its blog post related to CVE-2021-44228 affecting ArcGIS products, especially ArcGIS Enterprise and ArcGIS Server [1]. While this CVE affects the Java logging library `log4j`, all products using this library are vulnerable to Unauthenticated Remote Code Execution [2].\n\nArcGIS Enterprise components contain the vulnerable log4j library. However, Esri specifies in its blog post that there is no known exploit available for any version of a base ArcGIS Enterprise deployment or stand-alone ArcGIS Server at this time. Still, ESRI released a Log4Shell mitigation scripts that fully address CVE-2021-44228.\n\n# Technical Details\n\nThe vulnerability exists in the Java logging library log4j. An unauthenticated remote attacker might exploit this vulnerability by sending specially crafted content to the application to execute malicious code on the server [2].\n\n# Affected products\n\nAll versions of ArcGIS Enterprise and ArcGIS Server are vulnerable.\n\nNotes:\n\n- ArcGIS Monitor does not contain Log4j library, therefore, it is not vulnerable.\n- ArcGIS Pro contains log4j library but the vulnerability cannot be exploited since the software does not listen for remote traffic.\n\n# Recommendations\n\nEsri recommends to apply the mitigation script to all installations of ArcGIS Enterprise and ArcGIS Server of any version of the software as soon as possible. Note that the mitigation script only removes the vulnerable `JndiLookup` class, thereby the vulnerable log4j library version will still be present on the systems.\n\nThe instructions to run the mitigation script according to the products can be found here:\n\n- ArcGIS Server: \n- Portal for ArcGIS: \n- ArcGIS Data Store: \n- ArcGIS GeoEvent Server: \n\n# References\n\n[1] \n\n[2] \n", "content_html": "

History:

  • 16/12/2021 --- v1.0 -- Initial publication

Summary

On December 16th, Esri updated its blog post related to CVE-2021-44228 affecting ArcGIS products, especially ArcGIS Enterprise and ArcGIS Server [1]. While this CVE affects the Java logging library log4j, all products using this library are vulnerable to Unauthenticated Remote Code Execution [2].

ArcGIS Enterprise components contain the vulnerable log4j library. However, Esri specifies in its blog post that there is no known exploit available for any version of a base ArcGIS Enterprise deployment or stand-alone ArcGIS Server at this time. Still, ESRI released a Log4Shell mitigation scripts that fully address CVE-2021-44228.

Technical Details

The vulnerability exists in the Java logging library log4j. An unauthenticated remote attacker might exploit this vulnerability by sending specially crafted content to the application to execute malicious code on the server [2].

Affected products

All versions of ArcGIS Enterprise and ArcGIS Server are vulnerable.

Notes:

  • ArcGIS Monitor does not contain Log4j library, therefore, it is not vulnerable.
  • ArcGIS Pro contains log4j library but the vulnerability cannot be exploited since the software does not listen for remote traffic.

Recommendations

Esri recommends to apply the mitigation script to all installations of ArcGIS Enterprise and ArcGIS Server of any version of the software as soon as possible. Note that the mitigation script only removes the vulnerable JndiLookup class, thereby the vulnerable log4j library version will still be present on the systems.

The instructions to run the mitigation script according to the products can be found here:

References

[1] https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-software-and-cve-2021-44228-aka-log4shell-aka-logjam/

[2] https://media.cert.europa.eu/static/SecurityAdvisories/2021/CERT-EU-SA2021-067.pdf

", "licence": { "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)", "link": "https://creativecommons.org/licenses/by/4.0/", "restrictions": "https://cert.europa.eu/legal-notice", "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies" } }