Loading vulnerability…
CVE-2024-4879 is a critical input validation vulnerability in ServiceNow Now Platform affecting Vancouver and Washington DC releases, with reporting also indicating exposure in Utah patch lines. The flaw is described as a Jelly template injection issue in ServiceNow UI macros that can be reached without authentication and can lead to remote code execution in the context of the Now Platform. Research associated with this issue identified a pre-authentication injection point in a page title parameter rendered by a Jelly-based UI page, where insufficiently constrained sanitization and escaping allowed attacker-controlled input to reach executable template contexts. Apache Jelly rendering behavior in ServiceNow, including multi-phase evaluation of template expressions and executable tags, enabled crafted input to bypass intended restrictions and achieve server-side JavaScript execution. The vulnerability is therefore best characterized as improper validation of attacker-supplied input before it is incorporated into executable template processing on the platform.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository provides two Nuclei templates for detecting and exploiting CVE-2024-4879, a Jelly Template Injection vulnerability in ServiceNow's Now Platform (Vancouver and Washington DC releases). The main files are 'servicenow.yaml' (for detection via a multiplication result in the response) and 'servicenow-db-exploit.yaml' (for exploitation, extracting database configuration from the server). Both templates use crafted HTTP GET requests to the '/login.do' endpoint, injecting Jelly code via the 'jvar_page_title' parameter. The exploit template attempts to read the 'glide.db.properties' file, which may expose sensitive database credentials if the target is vulnerable. The repository is structured for use with the Nuclei scanning framework and is intended for both detection and exploitation of the vulnerability. No hardcoded IPs or domains are present; the templates are designed to be used against user-specified targets.
This repository contains a Python exploit script (CVE-2024-4879.py) and a README.md. The script targets ServiceNow instances vulnerable to CVE-2024-4879, a template injection vulnerability. It works by sending a crafted GET request to the /login.do endpoint with a malicious jvar_page_title parameter. If the vulnerability is present, the script attempts to read and dump the contents of the ServiceNow database configuration file (glide.db.properties), extracting sensitive information such as the database name, type, URL, user, and password. The script is operational, providing both detection and exploitation capabilities. It requires a list of target URLs and outputs results to the console, with color-coded status messages. The README provides usage instructions, requirements, and a disclaimer. No hardcoded IPs or domains are present; the script is designed to be used against user-supplied targets.
This repository contains a Python exploit (exploit.py) targeting CVE-2024-4879 in ServiceNow's Now Platform (Vancouver, Washington DC Now, and Utah releases). The exploit chains three vulnerabilities (Title Injection, Template Injection Mitigation Bypass, and Filesystem Filter Bypass) to achieve unauthenticated remote code execution via the /login.do endpoint. The script first checks if the target is vulnerable by injecting code that returns a known value. If vulnerable, it proceeds to extract the contents of the 'glide.db.properties' file (containing database credentials) and attempts to dump user credentials from the 'sys_user' table. The exploit is fully operational, requiring only the target's IP address, and provides clear output and file-based results. The repository consists of a README.md (usage instructions and background) and the main exploit script (exploit.py).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical pre-auth remote code execution vulnerability in ServiceNow Now Platform UI macros caused by input validation issues enabling Jelly template injection.
A critical remote code execution vulnerability in ServiceNow's Now Platform allowing unauthenticated attackers to execute arbitrary code, leading to data theft and operational disruption.
A ServiceNow vulnerability in the reported exploit chain that contributed to pre-auth compromise leading to full database access and access to configured MID servers.
A critical vulnerability in ServiceNow’s Now Platform that led to data breaches.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.