CVE-2024-8924: ServiceNow Now Platform SQLi Vulnerability

CVE-2024-8924 Overview

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information from the ServiceNow database. ServiceNow deployed an update to hosted instances and provided the update to partners and self-hosted customers. The vulnerability is addressed in the listed patches and hot fixes.

Critical Impact

Unauthenticated attackers can exploit this blind SQL injection vulnerability to extract sensitive data from ServiceNow instances without requiring any credentials, potentially exposing confidential business information, user data, and system configurations.

Affected Products

• ServiceNow Now Platform - Xanadu release (including Early Availability and Hotfix 1)
• ServiceNow Now Platform - Vancouver release (all patches from Patch 1 through Patch 10, including associated hotfixes)
• ServiceNow Now Platform - Washington DC release (all patches from Early Availability through Patch 6, including associated hotfixes)

Discovery Timeline

• October 29, 2024 - CVE-2024-8924 published to NVD
• November 27, 2024 - Last updated in NVD database

Technical Details for CVE-2024-8924

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The blind SQL injection variant present in the Now Platform allows attackers to infer database contents through boolean-based or time-based responses rather than direct data retrieval. Since the vulnerability is exploitable by unauthenticated users, it presents a significant risk to organizations using vulnerable ServiceNow instances, as no prior access or credentials are required to begin exploitation.

The network-based attack vector means that any internet-exposed ServiceNow instance running affected versions is potentially vulnerable. The confidentiality impact is substantial, as successful exploitation can lead to unauthorized extraction of database contents including potentially sensitive business data, workflow configurations, user information, and other organizational data stored within the platform.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the Now Platform's database query handling. User-supplied input is not adequately sanitized before being incorporated into SQL queries, allowing attackers to inject malicious SQL statements. The blind nature of the injection indicates that while direct query output is not returned to the attacker, the application's response behavior (timing differences or conditional responses) can be leveraged to systematically extract data character by character.

Attack Vector

The attack is conducted over the network without requiring authentication. An attacker can craft specially formatted HTTP requests containing SQL injection payloads targeted at vulnerable endpoints in the Now Platform. By analyzing the application's responses—either through measurable time delays (time-based blind SQL injection) or different response behaviors (boolean-based blind SQL injection)—the attacker can systematically extract database contents.

The exploitation process typically involves:

1. Identifying vulnerable input parameters in the Now Platform
2. Crafting SQL injection payloads that cause conditional responses
3. Using automated tools to iterate through database contents
4. Extracting sensitive information from tables accessible to the application's database user

Detection Methods for CVE-2024-8924

Indicators of Compromise

• Unusual SQL-related error messages or timeouts in ServiceNow application logs
• High volume of requests to specific ServiceNow endpoints with suspicious query parameters containing SQL syntax characters (', ", ;, --, UNION, SELECT, WAITFOR)
• Abnormally long response times indicating time-based SQL injection attempts
• Repeated requests with incrementally different payloads suggesting automated data extraction

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in requests to ServiceNow instances
• Enable detailed logging for all ServiceNow API and web requests, monitoring for SQL injection indicators
• Implement anomaly detection for request patterns that may indicate automated exploitation tools
• Use database activity monitoring to detect unusual query patterns or unauthorized data access

Monitoring Recommendations

• Monitor ServiceNow instance logs for repeated failed requests or unusual query patterns
• Set up alerts for requests containing common SQL injection payloads targeting your ServiceNow endpoints
• Track authentication failures and anonymous access attempts to sensitive endpoints
• Review network traffic to ServiceNow instances for signs of data exfiltration or unusual response sizes

How to Mitigate CVE-2024-8924

Immediate Actions Required

• Verify your ServiceNow instance version and patch level against the vulnerable versions list
• Apply the appropriate security patch or hotfix provided by ServiceNow immediately
• Review ServiceNow logs for any indicators of exploitation attempts prior to patching
• Ensure ServiceNow instances are not unnecessarily exposed to the public internet

Patch Information

ServiceNow has deployed updates to hosted instances automatically and has provided updates to partners and self-hosted customers. Organizations running self-hosted or partner-managed instances should apply the security patches as documented in the ServiceNow Knowledge Base Article KB1706072. The patches address the vulnerability across Xanadu, Vancouver, and Washington DC releases.

Workarounds

• Implement network-level access controls to limit who can reach ServiceNow instances while awaiting patch deployment
• Configure WAF rules to block requests containing SQL injection patterns
• Consider temporarily restricting anonymous access to the platform if business operations permit
• Enable enhanced logging and monitoring to detect any exploitation attempts

# Example: Review ServiceNow instance version (contact ServiceNow support for precise commands)
# Verify patch level against KB1706072 requirements
# Apply patches per ServiceNow documentation

# WAF rule example (generic pattern - adapt to your WAF platform)
# Block requests containing common SQL injection patterns:
# Pattern: (UNION|SELECT|INSERT|UPDATE|DELETE|DROP|WAITFOR|SLEEP)\s+
# Action: Block and log