Horizon Alert
Summary of the vulnerability and why it matters
ServiceNow's Now Platform has an input validation flaw that affects its Washington DC, Vancouver, and earlier releases. This weakness could permit an unauthenticated user to execute code remotely on the platform. The impact could include unauthorized system access and potential disruption to business operations.
- Vulnerable ServiceNow Now Platform
- Input validation flaw
- Remote code execution capability
Attack Path
How an attacker could exploit the issue
This vulnerability allows an unauthenticated user to execute code remotely on the ServiceNow platform. The attack leverages a weakness in how the platform handles certain inputs, enabling an attacker to bypass security controls. Successful exploitation could lead to unauthorized code execution within the affected system, potentially impacting data integrity and system availability.
- Exposed to the internet.
- Attacker sends malicious input.
- Code executes on the platform.
Live Threat
Current exploitation, exposure, and threat context
ServiceNow has addressed a critical vulnerability that could allow an unauthenticated attacker to remotely execute code. This vulnerability impacts several versions of the Now Platform. The issue stems from an incomplete list of disallowed inputs within the GlideExpression script.
- Attackers require no special skill.
- No access or conditions needed.
- Business risk is critical.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
An unauthenticated user could remotely execute code within the Now Platform due to a vulnerability. The vendor has released patches addressing this critical risk. Organizations should prioritize applying these fixes to affected instances.
- Find affected ServiceNow instances.
- Apply vendor security patches promptly.
- Verify patch installation and monitor systems.
