Imperva Customers Protected Against Critical ServiceNow Vulnerability

Introduction

ServiceNow is a widely used platform for IT service management, and its security is paramount for businesses relying on it for their operations. Recently, a critical vulnerability was discovered that could potentially allow attackers to access all data within ServiceNow instances. This vulnerability, tracked as CVE-2024-4879, has an initial CVSS score of 9.3, and can be chained with two other bugs (CVE-2024-5178 and CVE-2024-5217) to conduct unauthenticated remote code code execution, although currently only the first has a PoC available.

Imperva customers are protected from this vulnerability out of the box. Read on to learn more about the bug, and more steps you can take to protect your data.

Overview of the Vulnerability

Researchers discovered a chain of three bugs that, when exploited together, allow unauthorized access to all data in ServiceNow instances. This vulnerability affects a significant number of ServiceNow sites across various industries, highlighting the importance of immediate action to secure these environments.

The Three Bugs Explained

1. CVE-2024-4879: Authentication Bypass
The first vulnerability involves an authentication bypass that allows attackers to gain unauthorized access to the ServiceNow platform. By exploiting this bug, attackers can remotely execute code on the platform

2. CVE-2024-5178: Privilege Escalation
The second vulnerability enables privilege escalation, allowing attackers to elevate their permissions within the ServiceNow environment. This bug is particularly dangerous as it grants attackers administrative access, making it easier to manipulate data and system settings.

3. CVE-2024-5217: Arbitrary Data Access
The final vulnerability in the chain allows for arbitrary data access, enabling attackers to view and extract any data stored within the ServiceNow instance. This includes confidential information, customer data, and internal communications, posing a severe risk to business operations and data privacy.

Impact on Affected Sites

Exploitation attempts leveraging these vulnerabilities have been observed in over 6,000 sites across various industries, especially in the financial services industry. Attackers are primarily leveraging automated tools to target login pages. We’re seeing two common payloads across attacks: one to test if remote code execution (RCE) is possible, and another command to show database users and passwords. The potential for data breaches and unauthorized access to sensitive information underscores the critical nature of this issue.

Mitigation and Protection Strategies

Imperva customers are protected out of the box from these vulnerabilities. However, it’s always a good idea to implement additional security measures, such as:

• Patch and Update: ServiceNow has released patches to address these vulnerabilities. Ensure that all instances of ServiceNow are updated with the latest security patches. Regularly check for updates and apply them promptly to maintain a secure environment.

• Monitor and Audit Access: Regularly monitor and audit access logs to detect any unusual or unauthorized activity. Set up alerts for suspicious login attempts and investigate them promptly to prevent potential breaches.

• Educate and Train Staff: Educate your staff about the importance of security and the specific risks associated with this vulnerability. Conduct regular training sessions to ensure that all employees are aware of best practices for maintaining a secure ServiceNow environment.

Conclusion

The recent discovery of a critical vulnerability in ServiceNow underscores the importance of vigilance and proactive security measures. By understanding the nature of this vulnerability and implementing the recommended protection strategies, you can safeguard your data and maintain the integrity of your ServiceNow instances. Stay informed, stay secure, and take immediate action to protect your business from potential threats.

Subscribe to our weekly Threat Intelligence report for the latest updates on cybersecurity threats and best practices. Stay ahead of the curve and keep your data safe!