Rising Threat: Hackers Exploit Year-Old ServiceNow Security Vulnerabilities to Target Unpatched Systems
Security researchers have issued a crucial warning regarding a surge in cyberattacks exploiting three vulnerabilities in ServiceNow, an essential platform used by many organizations. These vulnerabilities, identified as CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217, have seen increased attempts at exploitation, highlighting the urgent need for companies to ensure their systems are patched.
Recent Surge in Exploitation Attempts
According to a blog post by GreyNoise, a threat intelligence startup, there has been a “notable resurgence of in-the-wild activity” targeting these three vulnerabilities. The initial disclosure of these flaws occurred in May 2024 by researchers from Assetnote, with ServiceNow implementing patches just two months later in July 2024.
Geographic Distribution of Attacks
GreyNoise reported that the majority of the malicious activity—approximately 70%—has been directed at systems located in Israel, but there have also been incidents in Germany, Japan, and Lithuania. This geographic diversity indicates a widespread interest in exploiting these vulnerabilities.
Risk of Data Exposure
As highlighted by Assetnote, these vulnerabilities can be chained together, potentially granting attackers full database access to affected ServiceNow instances. Organizations frequently utilize ServiceNow to manage sensitive employee data, including personally identifiable information and crucial HR records.
ServiceNow’s Response
In a statement to TechCrunch, ServiceNow spokesperson Erica Faltous remarked that the company became aware of the vulnerabilities nearly a year ago. She emphasized that, to date, there has been no observed impact on customers from any attack campaign related to these vulnerabilities.
Previous Warnings and Targeted Attacks
Following the vulnerabilities’ exposure, the U.S. security firm Resecurity issued warnings about attempts by foreign threat actors to exploit these weaknesses. Their investigations revealed targeted attacks on:
- Energy companies
- Data center organizations
- Middle Eastern government agencies
- Software developers
Additionally, a report from Imperva in July 2024 indicated that exploitation attempts were detected across 6,000 sites in various industries, with particular activity noted in the financial services sector.
Conclusion
The ongoing attempts to exploit these ServiceNow vulnerabilities underscore the critical need for organizations to apply security patches promptly and remain vigilant against potential cyber threats. Ensuring that systems are up to date not only protects sensitive data but also helps maintain trust in organizational integrity.
