ServiceNow flaws actively exploited by hackers

Threat actors are exploiting a chain of ServiceNow vulnerabilities using publicly available exploits to breach various government agencies and private firms.

ServiceNow, a cloud-based solution widely used for managing enterprise digital workflows, has been the primary target. FOFA internet scans revealing nearly 300,000 exposed instances of ServiceNow.

The primary vulnerability, tracked as CVE-2024-4879, is an input validation flaw with a CVSS score of 9.3. Additional vulnerabilities, CVE-2024-5178 and CVE-2024-5217, can be chained with CVE-2024-4879 for complete database access.

Assetnote researchers published a detailed write-up on the flaws, leading to the immediate appearance of working exploits and bulk network scanners on GitHub. Threat actors began leveraging these exploits to identify and compromise vulnerable instances.

If successful, attackers dump user lists and account credentials. While most credentials are hashed, some instances exposed plaintext credentials.

Victims include government agencies, data centers, energy providers, and software development firms. Compromised data includes user lists and account credentials, including some plaintext credentials.