CVE-2022-38199 - How a Simple File Download Bug in Esri ArcGIS Server Could Let Attackers Trick Users Into Running Malicious Files

Esri ArcGIS Server is a tool widely used for managing web mapping services and geospatial data. In 2022, a security vulnerability tracked as CVE-2022-38199 was discovered in its web services. This bug looks simple at first—a remote file download issue—but under the right conditions, it can expose unsuspecting users to dangerous malware execution.

In this long-post, we’ll break down what this vulnerability is, how it works, and how an attacker could exploit it. We’ll see code samples, learn how browsers try to reduce the risk, and why it’s still a big deal for organizations running ArcGIS.

What is CVE-2022-38199?

CVE-2022-38199 is a remote file download vulnerability found in certain versions of Esri ArcGIS Server. The issue exists in the way ArcGIS Server web services handle file download requests. Basically, a remote, unauthenticated attacker could craft a link that—when clicked by a victim—causes the victim’s computer to download a file and, in rare cases, execute a process placed in the victim's $PATH environment variable.

The vulnerability affects the file download functionality of ArcGIS Server’s web services.

- If exploited, the resulting file could be placed where it’s later run automatically, or the victim could be tricked into running it manually.

How Does the Exploit Work?

Let’s walk through a simplified version of the attack.

1. Attacker Crafts a Malicious Request

The attacker finds a vulnerable ArcGIS Server endpoint (for example, an exposed "export data" service). They prepare a URL like this:

https://example.com/arcgis/rest/services/MyData/MapServer/export?f=pitem&filetype=exe&filename=evil.exe

The parameters and exact service endpoint may differ. The key thing is, the attacker can supply a filename like evil.exe.

What happens next:
When the victim clicks the attacker-prepared link (perhaps in a phishing email or chat), ArcGIS Server responds by sending a file named evil.exe back to the victim's browser.

2. The File Lands in the Wrong Place

If the victim or their system is misconfigured, the download could land in a directory that is included in their $PATH environment variable. This could happen if:

- The victim manually saves the downloaded file to a system path (like C:\Windows\System32 or /usr/local/bin).

The victim double-clicks the file in their Downloads folder.

- An existing script or scheduled task runs an executable named the same as the malicious file, grabbing the attacker's file instead of a legitimate one, because it’s now earlier in the PATH.

Example evil Python file (to be converted to exe)

# evil.py
import os
import sys

def main():
    with open("CVE-2022-38199.txt", "w") as f:
        f.write("You've been hit by CVE-2022-38199!\n")
    print("Exploit ran. Check for CVE-2022-38199.txt")

if __name__ == "__main__":
    main()

Convert to .exe using pyinstaller

pyinstaller --onefile evil.py

Now, the attacker hosts evil.exe—not viral, but a demo.

Browser Protections: Not Always Enough

Modern browsers like Chrome, Edge, and Firefox try to protect users from running unsigned executables downloaded from the web. Typically, they’ll warn you with "This file isn’t commonly downloaded," or even block it by default.

But here’s the catch:

Many users ignore or bypass these warnings.

- Internal file transfer systems (like those in some companies or scientific institutions) may not inspect every downloaded file.
- Once the file is on disk, anything that runs executables based on PATH (even scripts or admin actions) could be tricked into running the malicious file.

Real-World Impact and Edge Cases

While exploitation requires both user interaction (the victim clicks and saves/runs the file) and improper handling (such as saving to an unsafe directory), this is still a high-risk vulnerability. Here are situations where it matters:

- Scripting Mistakes: An automated tool expects to run "arcgis.exe" and ends up launching the attacker’s file.
- Social Engineering: Attackers trick users to "update" certain tools by providing links through trusted platforms or phishing emails.

Original References

- NIST NVD Entry for CVE-2022-38199
- Esri Security Advisory
- ArcGIS Server Security Best Practices

What Should You Do?

- Patch: Make sure your ArcGIS Server is updated to a version where this vulnerability is fixed (check Esri’s security page for details).
- Validate Downloads: Ensure all downloads are not placed in system directories or anywhere in the PATH.
- User Education: Train users not to run executables from untrusted sources, and to heed browser warnings.

Conclusion

CVE-2022-38199 is a classic example of how a simple file download bug can turn into a big cybersecurity risk, especially when attackers combine it with social engineering or misconfiguration. Always keep your services patched, validate security settings, and stay sharp for suspicious downloads.

Stay secure! And if you want more deep dives like this, subscribe or follow for updates on the latest security news.

Timeline

Published on: 10/25/2022 17:15:00 UTC
Last modified on: 10/28/2022 19:37:00 UTC