Esri ArcGIS AllSource Untrusted Search Path Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in Esri ArcGIS AllSource versions 1.2 and 1.3, related to an untrusted search path. This vulnerability may enable a low-privileged attacker with write access to the local file system to place a malicious executable onto the system. If the victim subsequently performs a certain action within ArcGIS AllSource, the introduced executable could run and execute harmful commands, potentially under the victim's user context.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of malicious code, allowing an attacker to execute commands or perform actions on the system as the victim user.

Remediation

Users can upgrade to ArcGIS AllSource 1.2.1 or 1.3.1. These patches are available through the ArcGIS AllSource patch notification tool or can be downloaded from My Esri.