Unauthorized SQL Query Execution warning- ArcGIS map services

Question

A security scan of an application I maintain that uses several ArcGIS 10.7.1 map services (hosted with stand alone ArcGIS Server, not Enterprise, on AWS server, with IIS as web server) produced this warning for all of the map services:

Oracle Application Server PL/SQL Unauthorized SQL Query Execution It is possible to view, modify or delete database entries and tables.

I should note that we do not use Oracle databases. I assume this error is related to ArcGIS Server configuration (Apache Tomcat ?) All the map services are read-only and supported by file gdbs.

The report suggests this to remediate: Block unauthenticated PUBLIC access to PL/SQL procedures and applications by adding the following rule to the file "$ORACLE_HOME$\Apache\modplsql\cfg\wdbsvr.app":

exclusion_list= account*, sys., dbms_, owa*

Has anyone encountered this problem? I have never modified any internal configuration to ArcGIS Server.

Answer 1

According to Esri security support, this is a false positive:

Without additional information to indicate otherwise, this is a false positive as indicated in the application response.

AppScan only reads the HTTP 200 response code without validating the actual response body that indicates that the request is unsuccessful because the URL requested is invalid – that file doesn’t exist on the server.

Without additional information to indicate otherwise, this is a false positive as indicated in the application response.

AppScan only reads the http 200 response code without validating the actual response body that indicates that the request is unsuccessful because the URL requested is invalid – that file doesn’t exist on the server.

https://community.esri.com/t5/arcgis-enterprise-questions/owa-util-signature/td-p/655594