Critical ServiceNow Vulnerabilities Actively Exploited

THE THREAT

Critical vulnerabilities in ServiceNow are being actively exploited, enabling attackers to execute unauthorized code and gain full database access.

On July 10th, ServiceNow released updates for CVE-2024-4879 (CVSS: 9.3), CVE-2024-5217 (CVSS: 9.2), and CVE-2024-5178 (CVSS: 6.9). Both CVE-2024-4879 and CVE-2024-5217 allow for an unauthenticated, remote attacker to execute arbitrary code within the Now Platform. This access could potentially result in compromise, data theft, and disruption of business operations. CVE-2024-5178 enables users with administrative privileges to gain unauthorized access to sensitive files on the web application server.

As exploitation is currently ongoing, it is critical organizations apply patches immediately.

What we’re doing about it

• eSentire Managed Vulnerability Service (MVS) has plugins in place to detect the vulnerabilities
• eSentire’s Tactical Threat Response (TTR) team has developed new detections to identify exploitation attempts via eSentire MDR for Network
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• As updates are available organizations using vulnerable instances of ServiceNow are highly recommended to apply patches immediately

Additional information

These vulnerabilities were disclosed to ServiceNow on May 14th, 2024.

On July 11th, Assetnote published a technical analysis explaining how to exploit the vulnerabilities. These vulnerabilities can be chained together to first establish remote code execution, then to access sensitive information including usernames and password hashes. Shortly following release, Proof-of-Concept (PoC) exploit code and vulnerability scanners began being published on GitHub.

On July 24th, Resecurity released a report where they identified an ongoing campaign leveraging PoC code to exploit the vulnerabilities, gathering ServiceNow data from organizations.

References:

[1] https://www.resecurity.com/blog/article/cve-2024-4879-and-cve-2024-5217-servicenow-rce-exploitation-in-a-global-reconnaissance-campaign
[2] https://www.assetnote.io/resources/research/chaining-three-bugs-to-access-all-your-servicenow-data
[3] https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154 
[4] https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648312 
[5] https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313