ServiceNow Exposure Scanner: Open Source Tool

Post Views: 13

Snowpick: Open-source ServiceNow exposure scanner

Testing and Findings

An employee accesses a company’s service portal, searches the knowledge base, and uploads a file to a ticket. A user without authentication can send a request to the same portal and retrieve records. During authorized penetration tests, Bishop Fox tested 166 ServiceNow instances and discovered vulnerabilities in 31% of them. These instances responded to unauthenticated session requests with records or confirmed record counts, tracing to approximately 75% of the organizations in the dataset.

Exposure Causes

The exposed data resulted from access-control and configuration flaws on public ServiceNow interfaces rather than zero-day exploits, according to Emilio Gallegos, a security researcher at Bishop Fox who developed the tool.

ServiceNow delivers data through two primary surfaces: Service Portal widgets and the Table REST API. Widgets operate at /api/now/sp/widget/{widget_id}, accept POST requests, and support knowledge base searches, catalog pages, ticket forms, and attachment views. The Table REST API at /api/now/table/{table_name} directly queries database tables such as sys_user, incident, and oauth_entity. Each surface enforces its own access controls. Some instances restricted widgets but allowed table queries, with two cases in the dataset demonstrating this separation.

Tool Functionality

The attachment widget was the primary source of findings. This default widget returns metadata about files attached to tickets, including titles, descriptions, and internal process details like onboarding guides and access procedures. Exposed data included knowledge base articles, incident metadata, service catalog items, department structures, and facility locations. Record counts per instance ranged from dozens to thousands.

Snowpick’s Mechanism

Credential theft was not part of the testing, but the same surfaces could access oauth_entity and sys_user tables if access control lists (ACLs) permitted it. Snowpick functions by requesting the public login page, extracting the session token issued by ServiceNow, and reusing it for subsequent API calls. The tool probes default widgets and 26 predefined table and field pairs, while also identifying installed widgets and expanding its scope.

Implications and Debate

Custom widgets require manual discovery, as their access rules are not subject to platform review. The tool distinguishes between row exposure, where data is returned, and count oracles, where the system confirms the existence of records without disclosing them. This behavior aligns with Varonis Threat Labs’ documentation of blind inference, tracked as CVE-2025-3648.

Public Release Impact

For each finding, Snowpick logs the total record count, a sample of rows, and a curl command to replicate the request. The tool’s release sparked debate about its implications. While the underlying techniques were already public, Bishop Fox argued that making Snowpick available would not hinder attackers but would empower organizations to identify and address vulnerabilities proactively.

Mitigation Strategies

Researchers such as Aaron Costello and AppOmni had previously analyzed similar exposure patterns, including session token exploitation and ACL mechanics. Gallegos emphasized that withholding the tool would only delay remediation efforts, as unauthenticated access to public-facing systems remains a critical risk.

Recommendations

Mitigation strategies involve addressing both platform defaults and custom configurations. ServiceNow’s built-in guardrails for public widgets and table access can reduce risks, but organizations must also test their own instances from an attacker’s perspective. Remediation requires auditing public Service Portal widgets that return ticket, attachment, knowledge base, catalog, or list data. Separate reviews of table-level, field-level, and row-level ACLs are necessary, as a blocked widget might still be accessible through another widget that loads it.

Conclusion

Snowpick is freely available on GitHub, offering a resource for security teams to assess their ServiceNow environments. The tool underscores the shared responsibility between platform providers and customers to secure public-facing interfaces, highlighting the need for continuous testing and configuration reviews.