ServiceNow Platform Unauthenticated Blind SQL Injection (CVE-2024-8924)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(342267);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/03");

  script_cve_id("CVE-2024-8924");
  script_xref(name:"IAVA", value:"2024-A-0701");

  script_name(english:"ServiceNow Platform Unauthenticated Blind SQL Injection (CVE-2024-8924)");

  script_set_attribute(attribute:"synopsis", value:
"ServiceNow Platform is affected by an unauthenticated blind SQL injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Xanadu, Washington DC, and
earlier Now Platform releases. This vulnerability could potentially enable an unauthenticated user to acquire
unauthorized data stored within the Now Platform. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706072
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2f6f472d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the version referenced in the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-8924");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:servicenow:servicenow");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("servicenow_platform_web_detect.nbin");
  script_require_keys("installed_sw/ServiceNow Platform");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include('vcf_extras.inc');

var app_info = vcf::servicenow::get_app_info();

# Version format: '<patch>.<hotfix>' where hotfix is a number with an optional
# letter suffix, e.g. '3b'. VCF's default ord()-based alpha segment comparison
# ensures 10.3 < 10.3a < 10.3b < 10.4 without any custom conversions.
# The Release field (e.g. 'Vancouver') is used directly for constraint filtering.
#
# Washington DC: Patch 4 HF 2b is the fix for p<4 and p4 without HF 2b.
#   Patches 5 and 6 have no fix of their own; Patch 6 HF 1 and later still
#   precede the Patch 7 fix, so p5 and p6 are covered by the p7 constraint.
#   The min_version:'5.0' constraint covers all of p5/p6 (any hotfix) through p7.
var constraints = [
  # Xanadu: all installs before Patch 1 are vulnerable
  { 'release':'Xanadu',
    'fixed_version':'1.0',
    'fixed_display':'Xanadu Patch 1' },

  # Washington DC: < Patch 4 HF 2b
  { 'release':'Washington DC',
    'fixed_version':'4.2b',
    'fixed_display':'Washington DC Patch 4 Hot Fix 2b' },

  { 'release':'Washington DC',
    'min_version':'5.0',
    'fixed_version':'6.1',
    'fixed_display':'Washington DC Patch 6 Hot Fix 1 / Patch 7' },

  # Vancouver: < Patch 9 HF 3b
  { 'release':'Vancouver',
    'fixed_version':'9.3b',
    'fixed_display':'Vancouver Patch 9 Hot Fix 3b' },

  # Vancouver: Patch 10 HF < 2
  { 'release':'Vancouver',
    'min_version':'10.0',
    'fixed_version':'10.2',
    'fixed_display':'Vancouver Patch 10 Hot Fix 2' }
];

vcf::servicenow::check_version_and_report(
  app_info    : app_info,
  constraints : constraints,
  severity    : SECURITY_HOLE,
  flags       : {'sqli': TRUE}
);