0

A security scan of an application I maintain that uses several ArcGIS 10.7.1 map services (hosted with stand alone ArcGIS Server, not Enterprise, on AWS server, with IIS as web server) produced this warning for all of the map services:

Oracle Application Server PL/SQL Unauthorized SQL Query Execution It is possible to view, modify or delete database entries and tables.

I should note that we do not use Oracle databases. I assume this error is related to ArcGIS Server configuration (Apache Tomcat ?) All the map services are read-only and supported by file gdbs.

The report suggests this to remediate: Block unauthenticated PUBLIC access to PL/SQL procedures and applications by adding the following rule to the file "$ORACLE_HOME$\Apache\modplsql\cfg\wdbsvr.app":

exclusion_list= account*, sys., dbms_, owa*

Has anyone encountered this problem? I have never modified any internal configuration to ArcGIS Server.

4
  • 1
    If you revoke PUBLIC access, you'll need to explicitly grant the same access to the viewer/editor logins used in the website. Note that it is best practice to NOT publish maps as the owner of the data tables, and to use the principle of least privilege for all applications. – Vince Feb 8 at 17:25
  • @Vince I should have mentioned that we do not use Oracle databases, I think this warning is concerning Server's config, I edited my question. – JasonBK Feb 8 at 17:54
  • 1
    Heh. Then this looks like a false positive (bug in the security scanner) – Vince Feb 8 at 18:12
  • yes Esri think so as well, Ill post link in answer – JasonBK Feb 9 at 20:51
0

According to Esri security support, this is a false positive:

Without additional information to indicate otherwise, this is a false positive as indicated in the application response.

AppScan only reads the HTTP 200 response code without validating the actual response body that indicates that the request is unsuccessful because the URL requested is invalid – that file doesn’t exist on the server.

Without additional information to indicate otherwise, this is a false positive as indicated in the application response.

AppScan only reads the http 200 response code without validating the actual response body that indicates that the request is unsuccessful because the URL requested is invalid – that file doesn’t exist on the server.

https://community.esri.com/t5/arcgis-enterprise-questions/owa-util-signature/td-p/655594

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.