1

Recently a security audit has been done on our servers and applications which has ArcGIS enterprise installed on it.

Our Architecture setup :

We have ArcGIS installed on the server, ArcGIS exposes its data via its restful api for its clients which is authenticated with OAuth2 token security (Out of the box ESRI Feature) We have mobile applications for both iOS/Android and web which are built on top of ESRI SDK’s.some of the features in the app consumes data from ArcGIS rest services for their functioning.

The audit reported a potential vulnerability stating that one of the rest service disclose sensitive informations including email and phone numbers even for non authenticated users.

consider web application, we make use of esri’s proxy files to manage access to our resources for them. the vulnerability is found for the following feature server query through the rest interface,

/webapp/proxy/proxy.ashx?https://www.site.com/ArcGIS/rest/services/PublicPortal/xxxxxx/FeatureServer/0/query?f=json&where=EMAIL%20IS%20NOT%20NULL&returnGeometry=true&spatialRel=esriSpatialRelIntersects&outFields=*

I understand this as a problem with the ArcGIS rest services, but I’m not sure about this, if some one could, please clarify the following points

1)what could be done to mitigate this problem.

Kindly please help.

1

I find it very hard to believe that non authenticated users are getting a response to the query. I would suggest you to check in the arcgis/manager/ of the service, the permissions using the "Edit service security" as explained in this documentation link. This should be set to "Private" > "Allow access to all users who are logged in". Even better will be to set this to only the specific users of the query service!

If you still have an issue, maybe a solution will be to disable the REST API HTML-based representation access. Have a look on the ESRI documentation on this link because I have not implement this my self and I am not sure how it works.

Please let us know of the outcome.

  • sorry this was enbaled by default..still didnt work out – al_mukthar Nov 5 '18 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.