ServiceNow NOW Platform RCE via Improper Input Validation (CVE-2024-5217)
CVE-2024-5217 Published on July 10, 2024
Incomplete Input Validation in GlideExpression Script
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
Known Exploited Vulnerability
This ServiceNow Incomplete List of Disallowed Inputs Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.
The following remediation steps are recommended / required by August 19, 2024: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vulnerability Analysis
CVE-2024-5217 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors in an automatable fashion. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is a Denylist / Deny List Vulnerability?
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. Developers often try to protect their products against malicious input by performing tests against inputs that are known to be bad, such as special characters that can invoke new commands. However, such lists often only account for the most well-known bad inputs. Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
CVE-2024-5217 has been classified to as a Denylist / Deny List vulnerability or weakness.
Products Associated with CVE-2024-5217
Want to know whenever a new CVE is published for Servicenow? stack.watch will email you.
Affected Versions
ServiceNow Now Platform:- Before Utah Patch 10 Hot Fix 3 is affected.
- Before Utah Patch 10a Hot Fix 2 is affected.
- Before Utah Patch 10b Hot Fix 1 is affected.
- Before Vancouver Patch 6 Hot Fix 2 is affected.
- Before Vancouver Patch 7 Hot Fix 3b is affected.
- Before Vancouver Patch 8 Hot Fix 4 is affected.
- Before Vancouver Patch 9 Hot Fix 1 is affected.
- Before Vancouver Patch 10 is affected.
- Before Washington DC Patch 1 Hot Fix 3b is affected.
- Before Washington DC Patch 2 Hot Fix 2 is affected.
- Before Washington DC Patch 3 Hot Fix 2 is affected.
- Before Washington DC Patch 4 is affected.
- Before Washington DC Patch 5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
- Before utah_patch_10_hot_fix_3 is affected.
- Before utah_patch_10a_hot_fix_2 is affected.
- Before utah_patch_10b_hot_fix_1 is affected.
- Before vancouver_patch_6_hot_fix_2 is affected.
- Before vancouver_patch_7_hot_fix_3b is affected.
- Before vancouver_patch_8_hot_fix_4 is affected.
- Before vancouver_patch_9_hot_fix_1 is affected.
- Before vancouver_patch_10 is affected.
- Before washington_dc_patch_1_hot_fix_3b is affected.
- Before washington_dc_patch_2_hot_fix_2 is affected.
- Before washington_dc_patch_3_hot_fix_2 is affected.
- Before washington_dc_patch_4 is affected.
- Before washington_dc_patch_5 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.