CVE-2024-8923 Sandbox Escape in Now Platform

What is CVE-2024-8923?

CVE-2024-8923 is a critical code injection vulnerability in ServiceNow Now Platform, published on 29 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

Weakness: CWE-94

Which versions are affected by CVE-2024-8923?

It affects 1 product.

Products include Servicenow Servicenow.

How do I fix CVE-2024-8923?

No fix has been published for CVE-2024-8923 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-8923 being exploited?

There is no known exploitation of CVE-2024-8923 in the wild and no public exploit code.

Other vulnerabilities in ServiceNow Now Platform

• CVE-2024-4879 ServiceNow Improper Input Validation Exploited Critical 9.3
• CVE-2024-5217 ServiceNow Incomplete List of Disallowed Inputs Exploited Critical 9.2
• CVE-2022-43684 ACL bypass in Reporting functionality Critical 9.9
• CVE-2018-7748 Code injection in n/a High 8.8
• CVE-2024-8924 Unauthenticated Blind SQL Injection in Core Platform High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qpr4-w3rc-m373.