CVE-2025-3648: ServiceNow Platform Information Disclosure

CVE-2025-3648 Overview

A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them.

To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs.

Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations.

Critical Impact

Unauthorized data inference could lead to privacy violations and sensitive information exposure.

Affected Products

• Not Available
• Not Available
• Not Available

Discovery Timeline

• 2025-07-08T16:15:57.280 - CVE CVE-2025-3648 published to NVD
• 2025-07-08T17:15:34.267 - Last updated in NVD database

Technical Details for CVE-2025-3648

Vulnerability Analysis

The vulnerability stems from insufficient access control enforcement when processing range query requests. This can result in the leakage of inferable data without proper authorization.

Root Cause

Improper configuration in the access control list handling allowed unauthorized range queries to provide indirect access to data.

Attack Vector

The attack can be executed remotely over the network by leveraging improperly configured ACL settings, allowing attackers to perform range queries and infer sensitive data.

// Example exploitation code (sanitized)
const axios = require('axios');

async function exploit() {
    try {
        const response = await axios.get('https://example.com/api/data', {
            params: {
                range: 'sensitive_data_range'
            }
        });
        console.log('Inferred Data:', response.data);
    } catch (error) {
        console.error('Exploitation failed:', error.message);
    }
}

exploit();

Detection Methods for CVE-2025-3648

Indicators of Compromise

• Unusual range query requests in logs
• Unexpected access patterns to restricted data
• Multiple failed access attempts

Detection Strategies

Network and application logs should be monitored for unusual range query requests. Use threat intelligence feeds to identify suspicious IP addresses that might be probing access control weaknesses.

Monitoring Recommendations

Enhance logging for HTTP requests, focusing on range queries. Implement anomaly detection systems to identify deviations from regular access patterns.

How to Mitigate CVE-2025-3648

Immediate Actions Required

• Review and update ACL configurations
• Implement Query ACLs and Security Data Filters
• Monitor for unauthorized range queries

Patch Information

ServiceNow has released updates in May 2025 to address this issue. Customers are advised to apply the latest security updates and review ServiceNow's KB articles for detailed instructions.

Workarounds

Regularly audit ACL configurations and apply least privilege principles to minimize exposure. Consider implementing compensating controls like additional logging and monitoring.

# Configuration example
config set acl.strict_mode.enabled true
config set data_filtering.deny_unless_active true