CVE-2024-8924 Unauthenticated Blind SQL Injection in Core Platform

What is CVE-2024-8924?

CVE-2024-8924 is a high-severity SQL injection vulnerability in ServiceNow Now Platform, published on 29 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

Weakness: CWE-89

Which versions are affected by CVE-2024-8924?

It affects 1 product.

Products include Servicenow Servicenow.

How do I fix CVE-2024-8924?

No fix has been published for CVE-2024-8924 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-8924 being exploited?

There is no known exploitation of CVE-2024-8924 in the wild and no public exploit code.

Other vulnerabilities in ServiceNow Now Platform

• CVE-2024-4879 ServiceNow Improper Input Validation Exploited Critical 9.3
• CVE-2024-5217 ServiceNow Incomplete List of Disallowed Inputs Exploited Critical 9.2
• CVE-2022-43684 ACL bypass in Reporting functionality Critical 9.9
• CVE-2024-8923 Sandbox Escape in Now Platform Critical 9.3
• CVE-2018-7748 Code injection in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-25m4-rhwx-m523.