XSS vulnerabilities discovered in ServiceNow - CVE-2022-38463
Tags: poc
Published: 2022-10-29 05:39:01

---
title: XSS vulnerabilities discovered in ServiceNow - CVE-2022-38463
published: true
date: 2022-10-29 14:44:00 UTC
tags: Poc
canonical_url: https://tutorialboy24.blogspot.com/2022/09/xss-vulnerabilities-discovered-in.html
---

  

  

 ![](https://blogger.googleusercontent.com/img/a/AVvXsEhbWTAZguZV7brwHDRR7B6X1np3e7ufP880VcpPzUvDbw1aniuu4yDR2F30W1vch1byMTNAPgx_zwJB8v41XrYH96sdwNgO7mpKxNOiBKNDwalE0JkSE5gUDxuc3Zv2zJXEo-_u2dLgkKPoCIX7smIycXkhwjAZFZ5EVLYSw1LCIJYrLWRWg4FFaBG2ng=s16000)
  
Hey everyone, This is a blog related to my recent CVE on ServiceNow.

  

It was found while testing a bug bounty program that was using ServiceNow and their in-scope domain was ‘redacted.service-now.com’. I searched the ServiceNow exploits on google and found that the domain was vulnerable to CVE-2019-20768 and CVE-2021-45901. I reported them and the reports were accepted.

  

Then I tried to find some more bugs and came to an endpoint /logout\_redirect.do. After some testing, I discovered that this endpoint reflects the value of the sysparm\_url parameter in response.

  

Value of parameter - sysparm\_url is reflected in JavaScript. You can see the reflection here:

```
<script data-comment="loading_page redirect">setTimeout(function() {	top.location.href = 'VALUE-OF-SYSPARM_URL';}, 0);</script>
```

  

In the above code, we can clearly see that If we can add ‘javascript:alert()’ in the sysparm\_url parameter then we can achieve XSS. I tried ‘javascript:alert()’ and in response ‘javascript:’ was removed.

  

[![](https://blogger.googleusercontent.com/img/a/AVvXsEjMFnMQjvh17Ld-AN45IJtq5T3nCHRUb2G1dJfgV42QTPrQhfYeNw8fbctMoi-zRDGy4SnR4wxapGzaV3F4sRacdeLtSzSEKBNB7KFgScFERjZ6kXCMw1a9nH-oOFJo6MKkk4STMbR7OZ3QFe9O8qKYeKJkHnz63hwc0HMJvZ-2vbqY_SvldrwU1EOUyw=w640-h214)](https://blogger.googleusercontent.com/img/a/AVvXsEjMFnMQjvh17Ld-AN45IJtq5T3nCHRUb2G1dJfgV42QTPrQhfYeNw8fbctMoi-zRDGy4SnR4wxapGzaV3F4sRacdeLtSzSEKBNB7KFgScFERjZ6kXCMw1a9nH-oOFJo6MKkk4STMbR7OZ3QFe9O8qKYeKJkHnz63hwc0HMJvZ-2vbqY_SvldrwU1EOUyw)
  

  

Then I thought that If ‘javascript:’ word is getting removed then we can try ‘javajavascriptscript:’ so If ‘javascript’ will be removed then we still have a ‘javascript:’ but it didn’t work.

  

After playing with different types of encoding and trying different types of bypassing techniques. I found strange behavior in reflection.

  

So when I used ‘//aman:’ then the reflection is just ‘aman:’ without // so I replaced ‘//aman:’ with ‘//javascript:’ and I was expecting the reflection as ‘javascript:’ but I got ‘null’ in response.

  

[![](https://blogger.googleusercontent.com/img/a/AVvXsEjPttHshOajL6suCaw1YemAWIOYrO4id9h0MZad_xIvg67aqJtHspQvtGPV4EZdFNJQjezQinAZoqCU60PuVffxxtLJ9hUoGIjanJinvgsjC0OWYwSEk-K_ohByucy5GanKMpdRAFBNkgame7nYRpnK-uPSpkzADL6v47g58tTnpSxm8yizhSp-n1cOCA=s16000)](https://blogger.googleusercontent.com/img/a/AVvXsEjPttHshOajL6suCaw1YemAWIOYrO4id9h0MZad_xIvg67aqJtHspQvtGPV4EZdFNJQjezQinAZoqCU60PuVffxxtLJ9hUoGIjanJinvgsjC0OWYwSEk-K_ohByucy5GanKMpdRAFBNkgame7nYRpnK-uPSpkzADL6v47g58tTnpSxm8yizhSp-n1cOCA)
  

  

So after some workaround, I replaced // with //\ and I’m not sure why I did this but it worked and the reflection was ‘javascript:’

  

I used the payload : //\javascript:alert(document.domain)

  

and I got the ‘javascript:alert(document.domain)’ in response where ‘//\’ got removed.

  

[![](https://blogger.googleusercontent.com/img/a/AVvXsEjz53MbykFYeD04djTxoMyyzzSA8whNteJfYcwGqaOmnIBytb-4naNkg9fuB05dSmnU0dgKsfd4bmmR7RM99m6kkN7KD68Ec9-p6WQ9KV645IyBYK866rSKXkWvRvNTyfpsl0BzgAj9bal-pJfMvkMYPKw30ppXtCn6MlLeUgQUwvH1qUjTsu5WAiyAFg=s16000)](https://blogger.googleusercontent.com/img/a/AVvXsEjz53MbykFYeD04djTxoMyyzzSA8whNteJfYcwGqaOmnIBytb-4naNkg9fuB05dSmnU0dgKsfd4bmmR7RM99m6kkN7KD68Ec9-p6WQ9KV645IyBYK866rSKXkWvRvNTyfpsl0BzgAj9bal-pJfMvkMYPKw30ppXtCn6MlLeUgQUwvH1qUjTsu5WAiyAFg)
  

  

Opened the URL in the browser and we got a nice popup.

  

[![](https://blogger.googleusercontent.com/img/a/AVvXsEiipc6lGXatAp_T5sjpvb4Uy6qV_i-wN23CSA5y_BNjvuHfWQwFVikBv_LX5DK8FYwX3GXQnQRL8GVeLj-bKCWdkirCAjAi8AjgCda-TAEY5g9Y3m5oPYnL5ubtmjsVJbKTAxTNO-kL9do8J07pTUyfQrfdeL_QlWO8VXPVhSjpUJFNj37Y4ixUbXKNmg=s16000)](https://blogger.googleusercontent.com/img/a/AVvXsEiipc6lGXatAp_T5sjpvb4Uy6qV_i-wN23CSA5y_BNjvuHfWQwFVikBv_LX5DK8FYwX3GXQnQRL8GVeLj-bKCWdkirCAjAi8AjgCda-TAEY5g9Y3m5oPYnL5ubtmjsVJbKTAxTNO-kL9do8J07pTUyfQrfdeL_QlWO8VXPVhSjpUJFNj37Y4ixUbXKNmg)
  

  

### ServiceNow XSS 0-day in Bug Bounty Programs

I created a [nuclei template](https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2022/CVE-2022-38463.yaml) and scanned the bug bounty programs with nuclei and found that many companies were vulnerable to this.

  

[![](https://blogger.googleusercontent.com/img/a/AVvXsEiOXK5Zfki4MRO9PqPM8JG9YZYRKtA_CEJgnP4aq5ctbEMytNjT6h6wxPOdmUiGoQXSXSDA8yTBHl5WpMDca3zeDLY4drFujGickVbWDbDvapP-YHgqj2VDQDe7Dtn99LbwtO4VPQJkQ7ukcEhBGOZkluZoRy39O2ZHyj52ZRXO9SuU4h42LvoT7ykFEQ=s16000)](https://blogger.googleusercontent.com/img/a/AVvXsEiOXK5Zfki4MRO9PqPM8JG9YZYRKtA_CEJgnP4aq5ctbEMytNjT6h6wxPOdmUiGoQXSXSDA8yTBHl5WpMDca3zeDLY4drFujGickVbWDbDvapP-YHgqj2VDQDe7Dtn99LbwtO4VPQJkQ7ukcEhBGOZkluZoRy39O2ZHyj52ZRXO9SuU4h42LvoT7ykFEQ)

  

  

Reported this issue to ServiceNow through HackerOne. They fixed this issue and assigned CVE-2022-38463.

  

[![](https://blogger.googleusercontent.com/img/a/AVvXsEjlCFQvmFnxDOdV0hjcLRg2WgxEIAGQ9EL5KIiu-5j_js97GY9EulFq17GMCYW_wA5GOXW6AuphRzHOIYlNRkfwMgyIzWXF02mFsxuX9jCCRupeRL9qvvsahVkr4aOjmND8AJwU8ipyzkSHbk80gPBpeE8WrXbbZT7AYItoxQTP_6DXM-4qHLYo7-NBXg=s16000)](https://blogger.googleusercontent.com/img/a/AVvXsEjlCFQvmFnxDOdV0hjcLRg2WgxEIAGQ9EL5KIiu-5j_js97GY9EulFq17GMCYW_wA5GOXW6AuphRzHOIYlNRkfwMgyIzWXF02mFsxuX9jCCRupeRL9qvvsahVkr4aOjmND8AJwU8ipyzkSHbk80gPBpeE8WrXbbZT7AYItoxQTP_6DXM-4qHLYo7-NBXg)

  

## Recommended fix

Update ServiceNow instance to version - San Diego Patch 6, San Diego Patch 4b, Rome Patch 10a, Patch 9b, and Quebec Patch 10 HotFix 7b.

  

## Timeline

- 26 May 2022

  - - Reported to ServiceNow through HackerOne.

- 01 Jun 2022

  - - Report triaged.

- 25 Aug 2022

  - - CVE-2022-38463 assigned by ServiceNow.

- 29 Aug 2022

  - - ServiceNow allowed me to publish the blog.