Incomplete Input Validation in GlideExpression Script (CVE-2024-5217)

What is affected, what to do

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• ServiceNow eq utah..utah
• ServiceNow eq vancouver..vancouver
• ServiceNow eq washington_dc..washington_dc

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy the ServiceNow June 2024 hotfixes: Washington DC → Patch 1 Hot Fix 2, Patch 2 Hot Fix 2 or Patch 3; Vancouver → Patch 6 Hot Fix 2, Patch 7 Hot Fix 3b, Patch 8 Hot Fix 4, Patch 9 or Patch 10; Utah → Patch 10 Hot Fix 3 or Patch 10 Hot Fix 6. Verify build via HI Portal and stats.do.
   • Enumerate internet-exposed Now Platform instances (SaaS-hosted and self-hosted) and restrict them to trusted sources via IP allowlist, VPN enforcement or Access Policy until patched. Focus on unauthenticated endpoints such as /login.do, /$sys_portal.do, /xmlhttp.do and UI macros.
   • Hunt for pre-existing compromise: review sys_user_list.do for new admin accounts, sys_script.list and sys_script_include.list for unknown server-side script, and sys_update_xml for modifications since May 2024.
   • Rotate OAuth client secrets, MID server credentials, integration-user passwords and instance admin credentials if the instance was reachable from the internet before patching. Invalidate active sessions.
   • Freeze changes to Business Rules, Script Includes and UI Actions so forensic artefacts remain intact.
2. 02

   Runbook step 2

   Mitigation layers

   • Network: place the Now Platform front end behind a reverse proxy or WAF (F5, Cloudflare, Azure Front Door) and limit admin paths (/sys_*, /xmlhttp.do, /angular.do) to the admin VLAN.
   • WAF: block requests containing GlideExpression-typical payloads — URL-decoded strings with javascript:, GlideSystem, gs., Packages.java, getClass(, eval(, ${ inside query or POST parameters such as sysparm_*. Map OWASP CRS 933xxx rule family (PHP/JS injection) to Now Platform parameters.
   • Apply rate limiting and anomaly scoring to unauthenticated requests against UI macro endpoints; temporarily block source IPs exceeding ~20 req/min.
   • IAM hardening: set properties glide.ui.escape_text and glide.ui.escape_all_script to true, enable glide.script.block.client.globals, and prune sys_public pages to the strict minimum.
   • Egress control: restrict outbound traffic from instance and MID server to known integration targets so second-stage downloads and exfiltration are blocked.
   • Monitor ServiceNow system properties (glide.*.security.*) for mutation and alert via SOAR on any change.
3. 03

   Runbook step 3

   Detection rules

   • Reverse-proxy / WAF access logs: search for GET/POST requests whose parameters contain ${jndi, ${gs., javascript%3a, getClass, java.lang, Packages., returning HTTP 200 on /*.do without preceding auth. Sigma shape: selection: cs-uri-query|contains: ['${', 'getClass(', 'Packages.java'].
   • ServiceNow transaction logs (syslog_transaction): unauthenticated transactions as user guest or empty user context against non-public tables. KQL idea: syslog_transaction | where user == "guest" and url !startswith "/login" | summarize count() by client_ip, url.
   • New or modified rows in sys_script, sys_script_include, sys_ui_macro, sys_ui_action with sys_created_on after the suspected exposure window and sys_created_by = guest/system/unknown.
   • Network egress telemetry (Zeek/Suricata) from instance or MID server to atypical destinations (Pastebin, raw GitHub, DNS tunnel, Tor exit nodes); alert on CLI user agents such as curl, wget, python-requests originating from the instance.
   • SIEM correlation: unauthenticated request to /*.do with query string > 500 bytes, followed within 15 minutes by an admin login or role escalation on the same instance.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• ServiceNow Now Platform
• ServiceNow ServiceNow Now Platform

Weakness classes (CWE)

• CWE-184Incomplete List of Disallowed Inputs

  Base

  The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

  Entry at MITRE CWE-184

References & sources

• support.servicenow.comServiceNow advisory: CVE-2024-5217Vendor advisory, pwn-watch
• support.servicenow.comkb?id=kb_article_view&sysparm_article=KB1644293x_login-required, Permissions required
• darkreading.comcloud-security/patchnow-servicenow-critical-rce-bugs-active-exp…Press coverage
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5217government-resource, US government resource
• pwn.watchpwn.watch: ServiceNow Utah, Vancouver, and Washington DC Now Platform: 2 actively exploited vulnerabilitiespwn-watch
• support.servicenow.comServiceNow advisory: CVE-2024-4879pwn-watch
• NVD (NIST)NVD: CVE-2024-4879pwn-watch
• NVD (NIST)NVD: CVE-2024-5217pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch