Loading vulnerability…
CVE-2024-4879 is an improper input-validation vulnerability in ServiceNow Now Platform UI macros affecting vulnerable Utah, Vancouver, and Washington DC releases. A pre-authentication page-title value is rendered in an unescaped context. Although the value is passed through an HTML sanitizer, permitted style elements can carry XML/Jelly content through sanitization. ServiceNow’s two-phase Apache Jelly rendering can subsequently interpret the injected content as template syntax, enabling attacker-controlled server-side evaluation in the Now Platform context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository provides two Nuclei templates for detecting and exploiting CVE-2024-4879, a Jelly Template Injection vulnerability in ServiceNow's Now Platform (Vancouver and Washington DC releases). The main files are 'servicenow.yaml' (for detection via a multiplication result in the response) and 'servicenow-db-exploit.yaml' (for exploitation, extracting database configuration from the server). Both templates use crafted HTTP GET requests to the '/login.do' endpoint, injecting Jelly code via the 'jvar_page_title' parameter. The exploit template attempts to read the 'glide.db.properties' file, which may expose sensitive database credentials if the target is vulnerable. The repository is structured for use with the Nuclei scanning framework and is intended for both detection and exploitation of the vulnerability. No hardcoded IPs or domains are present; the templates are designed to be used against user-specified targets.
This repository contains a Python exploit script (CVE-2024-4879.py) and a README.md. The script targets ServiceNow instances vulnerable to CVE-2024-4879, a template injection vulnerability. It works by sending a crafted GET request to the /login.do endpoint with a malicious jvar_page_title parameter. If the vulnerability is present, the script attempts to read and dump the contents of the ServiceNow database configuration file (glide.db.properties), extracting sensitive information such as the database name, type, URL, user, and password. The script is operational, providing both detection and exploitation capabilities. It requires a list of target URLs and outputs results to the console, with color-coded status messages. The README provides usage instructions, requirements, and a disclaimer. No hardcoded IPs or domains are present; the script is designed to be used against user-supplied targets.
This repository contains a Python exploit (exploit.py) targeting CVE-2024-4879 in ServiceNow's Now Platform (Vancouver, Washington DC Now, and Utah releases). The exploit chains three vulnerabilities (Title Injection, Template Injection Mitigation Bypass, and Filesystem Filter Bypass) to achieve unauthenticated remote code execution via the /login.do endpoint. The script first checks if the target is vulnerable by injecting code that returns a known value. If vulnerable, it proceeds to extract the contents of the 'glide.db.properties' file (containing database credentials) and attempts to dump user credentials from the 'sys_user' table. The exploit is fully operational, requiring only the target's IP address, and provides clear output and file-based results. The repository consists of a README.md (usage instructions and background) and the main exploit script (exploit.py).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ServiceNow pre-auth title/content injection vulnerability that permits attacker-controlled content to enter the Jelly rendering pipeline and serves as the initial component of a chain leading to unauthorized instance compromise.
A ServiceNow vulnerability referenced as one of three flaws chained with publicly available exploits in prior data-theft attacks.
A critical pre-auth remote code execution vulnerability in ServiceNow Now Platform UI macros caused by input validation issues enabling Jelly template injection.
One of three ServiceNow vulnerabilities in an unauthenticated exploit chain affecting Vancouver and Washington instances, enabling arbitrary Glide scripting, command execution on connected MID servers, and local-file reading.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.