Tuesday, May 28, 2024

ServiceNow Misconfigurations Lead to Leak of Sensitive Data

ServiceNow has been alerted to a potential misconfiguration concern that might impact the security of its platform. The company is actively addressing the issue and working towards a resolution.

The issue involves Access Control Lists (ACLs), which are used to control access to tables and columns on the platform. 

If an ACL is empty or does not have any roles, conditions, or scripts, it could allow unauthorized users, including guests, to access some resources.

ServiceNow has found that unauthenticated users have limited access to the platform and can only access some authorized pages. 

However, some public portal widgets, such as SimpleListWidget, can query data from the system. ServiceNow advises customers to follow these steps to check and fix their ACLs:

Check ACL Configurations

Customers should find ACLs that do not have any roles, conditions, or scripts.

If they do not want unauthenticated users to access those tables, they should add `gs.isLoggedIn()` to the script section of the ACLs. This will prevent unauthenticated users from accessing those tables through public portal widgets.

General Security Measures

ServiceNow recommends a thorough review of all ACLs, especially those that are empty or have the role “Public,” to make sure they match the business and security requirements.

Customers should also review their public widgets and disable the “Public” flag if they do not need them.

Customers should use IP Address Access Control to restrict access to their instances to only trusted IP addresses. Alternatively, they can use Adaptive Authentication policies to apply more fine-grained authentication control, allowing mobile access but limiting access to specific IP ranges and subnets.

Explicit Roles Plugin

Instances that use the Explicit Roles plugin are not affected by this issue. ServiceNow advises customers who use this plugin to check their ACLs that have the “public” role and review their User Criteria configurations.

ServiceNow stresses the importance of taking proactive security measures and urges customers to follow these steps to protect their instances.

The guidelines for assessing User Criteria can be located at KB1123580.

ServiceNow will continue to investigate the issue and provide updates and guidance as needed. Stay tuned for more information on this issue.

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.


Latest articles

DDNS Service In Fortinet Or QNAP Embedded Devices Exposes Sensitive Data, Researchers Warn

Hackers employ DNS for various purposes like redirecting traffic to enable man-in-the-middle attacks, infecting...

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles