Outbreak Alert: ServiceNow Remote Code Execution Attack
| FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.  | |
| CVE ID | CVE-2024-4879 |
| CVE Title | ServiceNow Improper Input Validation Vulnerability |
| NVD Severity | CRITICAL |
| FortiRecon Severity | CRITICAL |
| FortiRecon Score | 90/100 |
| Exploited | Yes |
| Exploited by Ransomware Group(s) | No |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | Yes |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 8 |
| Darknet Mention(s) | 0 |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 6 (OSINT, TECHINT) |
| Social Media Mention(s) | 3 |
| Vendor Advisory: | https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154 |
| https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293 | |
| CVE ID | CVE-2024-5217 |
| CVE Title | ServiceNow Incomplete List of Disallowed Inputs Vulnerability |
| NVD Severity | CRITICAL |
| FortiRecon Severity | CRITICAL |
| FortiRecon Score | 90/100 |
| Exploited | Yes |
| Exploited by Ransomware Group(s) | No |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | Yes |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 1 |
| Darknet Mention(s) | 0 |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 4 (OSINT, TECHINT) |
| Social Media Mention(s) | 0 |
| Vendor Advisory: | https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313 |
| https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293 |
| CVE ID | CVE-2024-5178 |
| CVE Title | ServiceNow Information Disclosure Vulnerability |
| NVD Severity | Not Assigned |
| FortiRecon Severity | LOW |
| FortiRecon Score | 8/100 |
| Exploited | No |
| Exploited by Ransomware Group(s) | No |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | No |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 0 |
| Darknet Mention(s) | 0 |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 2 (OSINT, TECHINT) |
| Social Media Mention(s) | 1 |
| Vendor Advisory: | https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648312 |
| https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293 |
