ArcGIS Server Manager Security Issue

DimitarKolev

I see very easily exploited security issue with the ArcGIS 10+ Server Manager login.
Instead of redirecting to secured login page, a modal container is displayed on top of the page.
Very poor security design.

You can easily delete the LoginFormBackdrop in Chrome and circumvent the login.
Hacker's paradise.

[ATTACH=CONFIG]34767[/ATTACH]

To be secure, DO NOT  Enable administrative access to your site through the Web Adaptor.
I don't know how ESRI let that go for so long without a fix.

[ATTACH=CONFIG]34768[/ATTACH]

ArcGISLoginIssue.png

ArcGISWebAdaptor.png

Cake Cutting-GIS Day 2024-65.jpg (8256×5504).png

CAKE GIS Day 2024-62.jpg (8256×5504).png

chandesrisbasile1

Yes, that is why we do not use Web Adaptor.

http://forums.arcgis.com/threads/106739-Web-Adaptor-with-Admin-rights?highlight=token

http://resources.arcgis.com/en/help/main/10.1/index.html#/Configuring_the_Web_Adaptor_after_installation/01540000041q000000/

http://resources.arcgis.com/en/help/main/10.2/index.html#/Configuring_the_Web_Adaptor_after_installation/01540000041q000000/

I see very easily exploited security issue with the ArcGIS 10+ Server Manager login.
Instead of redirecting to secured login page, a modal container is displayed on top of the page.
Very poor security design.

You can easily delete the LoginFormBackdrop in Chrome and circumvent the login.
Hacker's paradise.

[ATTACH=CONFIG]34767[/ATTACH]

To be secure, DO NOT  Enable administrative access to your site through the Web Adaptor.
I don't know how ESRI let that go for so long without a fix.

[ATTACH=CONFIG]34768[/ATTACH]