id: servicenow-title-injection
info:
name: Service Now - Title Injection
author: DhiyaneshDk
severity: high
reference:
- https://www.assetnote.io/resources/research/chaining-three-bugs-to-access-all-your-servicenow-data
classification:
cpe: cpe:2.3:a:servicenow:servicenow:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: servicenow
product: servicenow
shodan-query:
- http.favicon.hash:1701804003
- http.title:"servicenow"
fofa-query:
- icon_hash=1701804003
- title="servicenow"
google-query: intitle:"servicenow"
tags: cve,cve2024,servicenow,injection,vuln
http:
- method: GET
path:
- "{{BaseURL}}/login.do?jvar_page_title=<style><foo>Injected Title</foo></style>"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '<title><style><foo>Injected Title</foo></style></title>'
- type: word
part: header
words:
- 'text/html'
- type: status
status:
- 200
# digest: 4b0a00483046022100d1978a9a673bf71e1532488afc446d99c74a74c2d2da4afa8ce00ceb40e44526022100f920d6dd17bacc5f9b772d8967eb61dcd1473976b3290e8ff3dab86e31c1b7c6:922c64590222798bb761d5b6d8e72950