Description
ServiceNow是一家提供企业级云计算服务的公司，其产品是一种基于云的服务管理解决方案。ServiceNow存在Jelly模板注入漏洞，此漏洞是由于程序未充分验证用户输入jvar_page_title的数据导致的。
ServiceNow CVE-2024-4879 Jelly模板注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/adysec/POC/blob/main/wpoc/ServiceNow%20UI/ServiceNow-UI%E5%AD%98%E5%9C%A8Jelly%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E(CVE-2024-4879).md
https://www.venustech.com.cn/new_type/aqtg/20240712/27733.html
https://avd.aliyun.com/detail?id=AVD-2024-4879
https://www.secrss.com/articles/68018
https://www.cnblogs.com/gobybot/p/18308112
https://www.ddpoc.com/DVB-2024-7477.html
https://blog.csdn.net/m0_62828084/article/details/145558013
https://vulnerability.circl.lu/vuln/cnvd-2024-32827
https://rivers.chaitin.cn/blog/cqq54lp0lnec5jjugf90
https://cloud.tencent.com/developer/article/2438109
https://x.com/seclink/status/1812021229068648752
https://fortiguard.fortinet.com/cn/outbreak-alert/servicenow-rce
https://cn-sec.com/archives/2986025.html
https://www.yingjikeji.cn/sys-nd/197.html
https://www.4awl.net/11835.html
https://cdn.isc.360.com/isc-cxo/2024_Vulnerability_Report.pdf
https://wiki.shikangsi.com/profile/2/?page=16
https://www.6cloudtech.com/portal/article/index/id/1216.html
https://zone.ci/e/search/result/index.php?page=370&searchid=212
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154
https://www.exploit-db.com/exploits/52410
https://www.broadcom.com/support/security-center/protection-bulletin/cve-2024-4879-servicenow-jelly-template-injection-vulnerability
https://codewithvamp.medium.com/servicenow-template-injection-vulnerability-cve-2024-4879-cve-2024-5178-cve-2024-5217-1165441beb8e
https://trust.servicenow.com/notifications/?type=cve_publication
https://www.tenable.com/plugins/nessus/286265
https://www.invicti.com/web-application-vulnerabilities/servicenow-ssti-cve-2024-4879
https://help.bitsighttech.com/hc/en-us/articles/25374542176407-ServiceNow-Vulnerability-Chain-CVE-2024-4879-CVE-2024-5217-CVE-2024-5178
https://nvd.nist.gov/vuln/detail/cve-2024-4879
https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2024-0589.html/
https://www.cyfirma.com/research/servicenow-rce-cve-2024-4879-vulnerability-analysis-and-exploitation/
https://www.deepwatch.com/labs/attackers-exploit-chain-of-vulnerabilities-in-servicenow-to-dump-user-list/
https://arcticwolf.com/resources/blog/cve-2024-4879-cve-2024-5178-cve-2024-5217/
https://www.linkedin.com/pulse/cve-2024-4879-cve-2024-5217-exposed-risks-rce-servicenow-nfmtc
https://www.resecurity.com/blog/article/cve-2024-4879-and-cve-2024-5217-servicenow-rce-exploitation-in-a-global-reconnaissance-campaign