Technical Tip: Blocking ServiceNow Remote Code Execution Attack in FortiGate

[amatos]

Description	This article describes how to block the 'ServiceNow Remote Code Execution' attack with FortiGate. ServiceNow recently disclosed this vulnerability in its software.
Scope	FortiGate, Intrusion Prevention.
Solution	There is already a newly created signature which handles the block of the 3 CVEs involved to this attack. The CVEs are CVE-2024-4879, CVE-2024-5217, CVE-2024-5178. More information is disclosed in the corresponding FortiGuard encyclopedia article. In order to block this attack via FortiGate, it is necessary to add the 'ServiceNow.jvar_page_title.Jelly.Remote.Code.Execution' signature in the Intrusion Prevention profile. For this attack, the default action is 'Block'. In this example, it was used on FortiGate in firmware 7.0.15.  After, apply the Intrusion Prevention profile in a Firewall Policy which handles traffic to and from this application: If the signature is not shown in the FortiGate Intrusion Prevention profile, run the following command to update the IPS database: execute update-now