8 ms·

ServiceNow Insecure Access Control to Full Admin Takeover

171 points by muscaw 3y ago

pmlnr 3y ago
Ah, ServiceNow. We had to hold a formal code review on the steaming pile of turd they delivered because it was so incredibly bad even testing it would have been a security risk. That's the quality you get from them.
frakt0x90 3y ago
Almost exactly a year from report to disclosure. I'm sure it varies a lot, but is that a normal timeline for something this severe?
- stigz 3y ago
  No, judging from the Disclosure Timeline at the very bottom, it appears the lengthy remediation is due to ServiceNow dragging their feet. Took them over a month, plus a followup email, just to get them to respond to the initial report.
- 6D794163636F756 3y ago
  It can really depend on the nature of the vulnerability and who discovered it. Based on the timeline at the bottom of this article it seems like this was way too slow. Based on the cve information this was ranked as 9.8. The last time I dealt with a bug that bad it was log4j. It was found on a Tuesday, patched on a Thursday, announced on a Friday, and I redeployed all of our servers over the weekend. The most egregious part in my eyes is the slow response to the initial contact. In shows that Service Now does not monitor it's reporting and that they don't care about security. If I were using a product of theirs to handle proprietary or privileged information I would no longer trust them.
  - cyrnel 3y ago
    I suspect the CVSS score has been over-estimated. For the "scope" metric, the "vulnerable component" and the "affected component" are both ServiceNow itself, so that should be "unchanged": https://security.stackexchange.com/a/129205 https://security.stackexchange.com/a/129205 That drops you down to an 8.8. Also, log4shell was a 10.0, which got that extra .2 points from not requiring any privs, whereas this ServiceNow vuln requires "low" privs.
    - manvillej 3y ago
      Hi, ServiceNow dev here. I'd agree that the CVSS might be a little overinflated, but I don't think by much. I would argue that ServiceNow as a singular component is flawed. It could be several applications on a single instance: Vulnerability Response, Security Incident Response, IT Service Management, IT Operations management, Vendor Risk Management, CMDB, etc. I actually think in some instances, this vulnerability is considerably worse due the information it provides. User contact information, an inventory of the security vulnerabilities across the organization, applications & versions, Server information, etc. The social engineering issues are massive since they can spoof from essentially your service desk. Often times ServiceNow has access to other subsystems. Midservers, provisioning tools, monitoring systems, desktop orchestration tools. These systems are often used to handle the response & monitoring. The ServiceNow teams are often understaffed and underskilled. I've only been thinking about this for the last hour, but compromise 1 account (and I can think of at least 5 different ways that could happen) and a hacker could have: - a complete topology of your infrastructure - your active security vulnerabilities - contact information for your entire company - a very convincing spoofing method - the ability to remotely install software on customer desktops - the ability to monitor your response to security issues - access to your provisioning tools This kind of attack could go undetected for years. God forbid ServiceNow's internal instance got compromised. They can remote in to ANY instance.
- genmud 3y ago
  In any other software I would say no, but it's ServiceNow, so yes.
- technion 3y ago
  My experience with this sort of enterprise software is that if you are a user, there is usually someone higher up the org chart than you that is worried such a disclosure will damage his relationship with his mate. My point being, much like Oracle, the usual timeline is that you never go public.
  - acdha 3y ago
    Yes - I worked at a place which had that experience with them. Massive outage: down for weeks, data lost, etc. We paid millions for “support” and had very little to show for it. Things escalated, and their regional VP took our senior VP out to the corporate box to discuss it over football. Monday morning, word came out to stop talking about the problem where possible. A bunch of people worked nights & weekends to get it patched up but didn’t even get thanked by anyone above their immediate supervisor.
    - clintfred 3y ago
      That story makes me incredibly angry, and quite sad, actually.
- manvillej 3y ago
  ServiceNow ships major upgrades twice a year and patches every month. It means that they could genuinely not figure out how to remediate this quickly and quietly without disrupting ongoing contract negotiations. It means that even with that, they couldn't fix it for a whole year. They negotiate multiyear contracts. they're investing into government and healthcare services.
  - manvillej 3y ago
    I have to correct myself. Apparently the vulnerability was patched in San Diego patch 7 which was release on September 1st 2022. It wasn't disclosed until June 2023. I am still mad they didn't release it as a hotfix, but that meant they couldn't sneak it under the radar.
chevman 3y ago
Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantly broken. People talk shit about it all day, every day. Maybe one day, some time a long time ago they had a good product, and that's how it got embedded all over the place, but now, what a pile of junk!
- maximinus_thrax 3y ago
  > People talk shit about it all day, every day. In my two-decade long career, I don't think I ever heard about any enterprise software for which that statement is false.
  - Aeolun 3y ago
    We use Slack, which is pretty decent. We also use Github, which has been historically great. There’s Bulas, which is a timekeeping application developed somewhere in 1995 (I think) that’s just server rendered HTML and is a joy to use (especially compared to the other piles of crap).
- SteveNuts 3y ago
  Have you ever heard of Cherwell?
  - binarysneaker 3y ago
    shivers
- clivestaples 3y ago
  I worked there for exactly two months. After 15 days, I could not receive another offer and put in my notice fast enough. Ended up giving them four days. And I'm usually very careful about not burning bridges.
pm2222 3y ago
My vote goes to snow it’s much better than servicecenter and remedy. I’m a user only not admin or dev.
- doctaj 3y ago
  Omg. “Snow”. You’re one of “them”.
- Sylamore 3y ago
  Eh, Remedy has lots of issues but I'd take it over "SNow" any day - at least it's easy to build CLI tools or API calls into Remedy. I'm neither an admin or user of either, just an end user.
miguelazo 3y ago
Does anyone else get a security warning about a background download when visiting this page?
dvorak_typist 3y ago
InSecurityNow? Fuck'm with prejudice. Keep digging. RCE as admin has been a problem for over a decade. _Globally_ sessions do not expire... This is just the tip of the shit architecture iceberg.
rzimmerman 3y ago
Summary from what I read: Any user can query pretty much any table in the DB using their "GQL" wrapper around SQL. Someone thought enough to restrict the "user_password" field, so instead you query another table which gives you the user's session ID. Normally a token is user session ID + signature. But it turns out the signature wasn't really being validated, so user session ID + anything worked. I'm normally not one to jump on mistakes, but that's remarkably bad.
mschuster91 3y ago
And yet, it's leagues better than HP Service Manager or, heaven forbid, that ticket system someone created in Lotus Notes... Ticket systems are always a giant pain.

171 points by muscaw 3y ago

Ah, ServiceNow. We had to hold a formal code review on the steaming pile of turd they delivered because it was so incredibly bad even testing it would have been a security risk. That's the quality you get from them.

frakt0x90 3y ago

Almost exactly a year from report to disclosure. I'm sure it varies a lot, but is that a normal timeline for something this severe?

stigz 3y ago
No, judging from the Disclosure Timeline at the very bottom, it appears the lengthy remediation is due to ServiceNow dragging their feet. Took them over a month, plus a followup email, just to get them to respond to the initial report.
6D794163636F756 3y ago
It can really depend on the nature of the vulnerability and who discovered it. Based on the timeline at the bottom of this article it seems like this was way too slow. Based on the cve information this was ranked as 9.8. The last time I dealt with a bug that bad it was log4j. It was found on a Tuesday, patched on a Thursday, announced on a Friday, and I redeployed all of our servers over the weekend. The most egregious part in my eyes is the slow response to the initial contact. In shows that Service Now does not monitor it's reporting and that they don't care about security. If I were using a product of theirs to handle proprietary or privileged information I would no longer trust them.
- cyrnel 3y ago
  I suspect the CVSS score has been over-estimated. For the "scope" metric, the "vulnerable component" and the "affected component" are both ServiceNow itself, so that should be "unchanged": https://security.stackexchange.com/a/129205 https://security.stackexchange.com/a/129205 That drops you down to an 8.8. Also, log4shell was a 10.0, which got that extra .2 points from not requiring any privs, whereas this ServiceNow vuln requires "low" privs.
  - manvillej 3y ago
    Hi, ServiceNow dev here. I'd agree that the CVSS might be a little overinflated, but I don't think by much. I would argue that ServiceNow as a singular component is flawed. It could be several applications on a single instance: Vulnerability Response, Security Incident Response, IT Service Management, IT Operations management, Vendor Risk Management, CMDB, etc. I actually think in some instances, this vulnerability is considerably worse due the information it provides. User contact information, an inventory of the security vulnerabilities across the organization, applications & versions, Server information, etc. The social engineering issues are massive since they can spoof from essentially your service desk. Often times ServiceNow has access to other subsystems. Midservers, provisioning tools, monitoring systems, desktop orchestration tools. These systems are often used to handle the response & monitoring. The ServiceNow teams are often understaffed and underskilled. I've only been thinking about this for the last hour, but compromise 1 account (and I can think of at least 5 different ways that could happen) and a hacker could have: - a complete topology of your infrastructure - your active security vulnerabilities - contact information for your entire company - a very convincing spoofing method - the ability to remotely install software on customer desktops - the ability to monitor your response to security issues - access to your provisioning tools This kind of attack could go undetected for years. God forbid ServiceNow's internal instance got compromised. They can remote in to ANY instance.
genmud 3y ago
In any other software I would say no, but it's ServiceNow, so yes.
technion 3y ago
My experience with this sort of enterprise software is that if you are a user, there is usually someone higher up the org chart than you that is worried such a disclosure will damage his relationship with his mate. My point being, much like Oracle, the usual timeline is that you never go public.
- acdha 3y ago
  Yes - I worked at a place which had that experience with them. Massive outage: down for weeks, data lost, etc. We paid millions for “support” and had very little to show for it. Things escalated, and their regional VP took our senior VP out to the corporate box to discuss it over football. Monday morning, word came out to stop talking about the problem where possible. A bunch of people worked nights & weekends to get it patched up but didn’t even get thanked by anyone above their immediate supervisor.
  - clintfred 3y ago
    That story makes me incredibly angry, and quite sad, actually.
manvillej 3y ago
ServiceNow ships major upgrades twice a year and patches every month. It means that they could genuinely not figure out how to remediate this quickly and quietly without disrupting ongoing contract negotiations. It means that even with that, they couldn't fix it for a whole year. They negotiate multiyear contracts. they're investing into government and healthcare services.
- manvillej 3y ago
  I have to correct myself. Apparently the vulnerability was patched in San Diego patch 7 which was release on September 1st 2022. It wasn't disclosed until June 2023. I am still mad they didn't release it as a hotfix, but that meant they couldn't sneak it under the radar.

chevman 3y ago

Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantly broken. People talk shit about it all day, every day. Maybe one day, some time a long time ago they had a good product, and that's how it got embedded all over the place, but now, what a pile of junk!

maximinus_thrax 3y ago
> People talk shit about it all day, every day. In my two-decade long career, I don't think I ever heard about any enterprise software for which that statement is false.
- Aeolun 3y ago
  We use Slack, which is pretty decent. We also use Github, which has been historically great. There’s Bulas, which is a timekeeping application developed somewhere in 1995 (I think) that’s just server rendered HTML and is a joy to use (especially compared to the other piles of crap).
SteveNuts 3y ago
Have you ever heard of Cherwell?
- binarysneaker 3y ago
  shivers
clivestaples 3y ago
I worked there for exactly two months. After 15 days, I could not receive another offer and put in my notice fast enough. Ended up giving them four days. And I'm usually very careful about not burning bridges.

pm2222 3y ago

My vote goes to snow it’s much better than servicecenter and remedy. I’m a user only not admin or dev.

doctaj 3y ago
Omg. “Snow”. You’re one of “them”.
Sylamore 3y ago
Eh, Remedy has lots of issues but I'd take it over "SNow" any day - at least it's easy to build CLI tools or API calls into Remedy. I'm neither an admin or user of either, just an end user.

miguelazo 3y ago

Does anyone else get a security warning about a background download when visiting this page?

dvorak_typist 3y ago

InSecurityNow? Fuck'm with prejudice. Keep digging. RCE as admin has been a problem for over a decade. _Globally_ sessions do not expire... This is just the tip of the shit architecture iceberg.

rzimmerman 3y ago

Summary from what I read: Any user can query pretty much any table in the DB using their "GQL" wrapper around SQL. Someone thought enough to restrict the "user_password" field, so instead you query another table which gives you the user's session ID. Normally a token is user session ID + signature. But it turns out the signature wasn't really being validated, so user session ID + anything worked. I'm normally not one to jump on mistakes, but that's remarkably bad.

mschuster91 3y ago

And yet, it's leagues better than HP Service Manager or, heaven forbid, that ticket system someone created in Lotus Notes... Ticket systems are always a giant pain.