CVE-2024-4879 PoC — Jelly Template Injection Vulnerability in ServiceNow UI Macros

Source

https://github.com/0xWhoami35/CVE-2024-4879

Associated Vulnerability

Title:Jelly Template Injection Vulnerability in ServiceNow UI Macros (CVE-2024-4879)
Description:ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Readme

# CVE-2024-4879

ServiceNow, a widely used platform for business transformation, has recently disclosed three critical security vulnerabilities that could have severe consequences for organizations worldwide. These vulnerabilities, identified as CVE-2024–4879, CVE-2024–5217, and CVE-2024–5178, affect various versions of the Now Platform.

The most alarming of these flaws are CVE-2024–4879 and CVE-2024–5217, both carrying a critical CVSSv4 score of 9.3 and 9.2, respectively. These vulnerabilities enable unauthenticated remote attackers to execute arbitrary code within the Now Platform, potentially leading to complete system compromise, data theft, and disruption of critical business operations.

## Dorking
```
FOFA Query: app="servicenow-Products"
SHODAn Query: Server: ServiceNow
```
## Features
- Can Scans mass targets
- Dump Database
- Handles SSL warnings



## Installation
```
git clone https://github.com/0xWhoami35/CVE-2024-4879.git
cd CVE-2024-4879
pip3 install -r requirements.txt (Install python library)
python3 exp.py -i https://example.com (For Single Target)
python3 exp.py -m urls.txt (For multiple targets)
```

## PoC

![Uploading image.png…]()

File Snapshot


 [4.0K]  /data/pocs/7e0ab517e64a564294b6919bd67ee5a4fc63fcfd
├── [6.7K]  exp.py
├── [1.2K]  README.md
└── [  44]  requirements.txt

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!