CVE-2024-8923: ServiceNow Now Platform RCE Vulnerability

CVE-2024-8923 Overview

CVE-2024-8923 is a critical input validation vulnerability identified in the ServiceNow Now Platform that enables unauthenticated remote code execution. This flaw allows attackers to execute arbitrary code within the context of the Now Platform without requiring any authentication credentials, posing a severe threat to organizations relying on ServiceNow for IT service management and digital workflows.

ServiceNow has addressed this vulnerability by deploying updates to hosted instances and providing patches to partners and self-hosted customers. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code, also known as Code Injection), indicating that the platform fails to properly neutralize user-controlled input before using it in dynamically generated code.

Critical Impact

Unauthenticated attackers can remotely execute arbitrary code within the Now Platform context, potentially leading to complete system compromise, data exfiltration, and lateral movement across connected enterprise systems.

Affected Products

• ServiceNow Now Platform - Xanadu (Early Availability and Hotfix 1)
• ServiceNow Now Platform - Washington DC (All versions through Patch 4 Hotfix 1)
• ServiceNow Now Platform - Vancouver (All versions through Patch 9 Hotfix 2)

Discovery Timeline

• October 29, 2024 - CVE-2024-8923 published to NVD
• November 27, 2024 - Last updated in NVD database

Technical Details for CVE-2024-8923

Vulnerability Analysis

This vulnerability stems from insufficient input validation within the ServiceNow Now Platform's code generation mechanisms. When user-supplied input is processed by the platform, it fails to adequately sanitize or validate the data before incorporating it into dynamically executed code. This architectural weakness creates an attack surface that enables code injection attacks.

The vulnerability is particularly dangerous because it requires no authentication, meaning any network-accessible instance is potentially at risk. An attacker can craft malicious input that, when processed by the vulnerable component, results in arbitrary code execution within the platform's execution context. This grants the attacker the same privileges as the Now Platform service, which typically has extensive access to sensitive enterprise data and integrations.

Root Cause

The root cause of CVE-2024-8923 is improper control of code generation (CWE-94). The Now Platform contains functionality that dynamically generates and executes code based on user input. The vulnerable code path lacks adequate input validation and sanitization controls, allowing specially crafted input to escape the intended data context and be interpreted as executable code.

This type of vulnerability commonly occurs when:

• User input is directly concatenated into code strings without encoding
• Input validation relies on blocklists rather than allowlists
• Trust boundaries are not properly enforced between user-supplied data and code execution contexts

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to a vulnerable ServiceNow instance can exploit this vulnerability by:

1. Identifying a publicly accessible or network-reachable ServiceNow Now Platform instance
2. Crafting malicious input designed to escape the data context and inject executable code
3. Submitting the payload through the vulnerable input handling mechanism
4. Achieving code execution within the Now Platform's runtime environment

The exploitation complexity is low, as the attack does not require special conditions or additional vulnerabilities to succeed. Upon successful exploitation, attackers can potentially access confidential data, modify platform configurations, establish persistence, or pivot to other connected systems.

For detailed technical information about this vulnerability, refer to the ServiceNow Knowledge Base Article.

Detection Methods for CVE-2024-8923

Indicators of Compromise

• Unusual code execution patterns or unexpected processes spawned by the ServiceNow platform
• Anomalous network connections originating from ServiceNow servers to external or unexpected destinations
• Suspicious log entries indicating malformed or unusual input being processed by the platform
• Evidence of data exfiltration or unauthorized access to ServiceNow databases and configurations

Detection Strategies

• Monitor ServiceNow application logs for code injection patterns and error messages indicating input validation failures
• Implement network traffic analysis to identify anomalous outbound connections from ServiceNow infrastructure
• Deploy endpoint detection and response (EDR) solutions on ServiceNow servers to detect unauthorized code execution
• Establish baseline behavior for ServiceNow processes and alert on deviations

Monitoring Recommendations

• Enable comprehensive audit logging within ServiceNow and forward logs to a centralized SIEM platform
• Configure alerts for failed authentication attempts and unusual API activity patterns
• Implement network segmentation monitoring to detect lateral movement attempts from ServiceNow servers
• Review ServiceNow instance configurations regularly to ensure security controls remain properly configured

How to Mitigate CVE-2024-8923

Immediate Actions Required

• Apply the appropriate security patch immediately based on your ServiceNow release version (Vancouver, Washington DC, or Xanadu)
• If using hosted ServiceNow instances, verify with ServiceNow support that the update has been applied
• For self-hosted instances, download and apply the patches from the ServiceNow support portal
• Conduct a security review to identify any potential compromise before patching

Patch Information

ServiceNow has released security patches addressing this vulnerability across all affected release families. Hosted instances have been automatically updated by ServiceNow. Partners and self-hosted customers should obtain the appropriate patch from the ServiceNow Knowledge Base Article KB1706070.

The following versions include the fix:

• Vancouver: Patch 10 and later, or applicable hotfixes for Patch 9
• Washington DC: Patch 5 and later, or applicable hotfixes for Patch 4
• Xanadu: Hotfix 2 and later

Workarounds

• Restrict network access to ServiceNow instances using firewall rules and access control lists to limit exposure
• Implement a web application firewall (WAF) with rules to detect and block code injection attempts
• Enable IP-based access restrictions within ServiceNow to limit which networks can access the platform
• Consider temporarily disabling public access to the instance until patches can be applied

# Example: Review ServiceNow instance version and patch level
# Access System Diagnostics > Stats > Stats to verify current version
# Compare against patched versions listed in KB1706070

# Verify network restrictions are in place
# Review ACLs and firewall rules limiting access to ServiceNow endpoints