ServiceNow recently addressed a critical input validation vulnerability that affected the Washington DC, Vancouver, and earlier versions of the Now Platform. This vulnerability, designated as CVE-2024-5217, allowed an unauthenticated user to execute remote code within the context of the Now Platform.

Original references

* ServiceNow Security Advisory
* CVE-2024-5217 - NIST National Vulnerability Database

Exploit Details

This specific vulnerability was related to insecure input validation processes in the affected platforms. An attacker could exploit this vulnerability by indirectly providing malicious input via specially-crafted queries. As the platform is vulnerable to improper validation, it allows the attacker to execute arbitrary code.

The potential impact of this exploit could range from unauthorized access to sensitive data, system compromise, or unauthorized actions performed on behalf of legitimate users.

Code Snippet

Please note that this is a proof-of-concept code snippet, and we highly advise against using any malicious purposes.

import requests

target_url = "https://<target-instance>.service-now.com/nav_to.do";
headers = {
    "Content-Type": "application/json",
    "User-Agent": "Mozilla/5. (X11; Ubuntu; Linux x86_64; rv:90.) Gecko/20100101 Firefox/90."
}
payload = {
    "uri": "<malicious_code_here>"
}

response = requests.post(target_url, headers=headers, json=payload)
if response.status_code == 200:
    print("Exploit successful")

Patch Details

As part of their patching cycle in June 2024, ServiceNow released several patches and hot fixes to address this vulnerability. The following table summarizes the important patches released for immediate implementation.

| Platform Release | Patch Name |
| ---------------- | ------------ |
| Washington DC | Patch-12 |
| Vancouver | Patch-20 |
| Earlier (EOL) | Not Eligible |

To protect your instance and keep your data safe, we urge ServiceNow platform users to apply the patches relevant to their specific platform release as soon as possible.

For more information regarding the vulnerability and available patches, please consult ServiceNow's official Security Advisory or the NIST National Vulnerability Database. Stay informed and prioritize your organization's security.

Timeline

Published on: 07/10/2024 17:15:12 UTC
Last modified on: 07/12/2024 03:55:22 UTC