Three CVSS 10.0 ServiceNow AI Platform Flaws: Unauthenticated RCE and SQL Injection — Detection and Remediation Guide

---
title: ServiceNow Tomcat Process Spawning Shell or System Utility
id: 9c2e7a41-3b58-4f6d-a1e9-5d8c2f7b3e6a
status: experimental
description: Detects the Java/Tomcat process hosting a self-hosted ServiceNow instance spawning command shells or system utilities, consistent with remote code execution or web shell deployment following exploitation of the ServiceNow AI Platform flaws.
references:
  - https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/07
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'tomcat'
      - 'catalina'
      - 'servicenow'
      - 'java'
  selection_image:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
      - '/id'
      - '/whoami'
  condition: selection_parent and selection_image
falsepositives:
  - ServiceNow MID Server or discovery jobs may legitimately invoke system commands from the application context — baseline per-instance and alert on deviations
  - Vendor support scripts executed during maintenance windows
level: high
---
title: SQL Injection Probes Against ServiceNow Web Endpoints
id: 4f1b8d63-7e2a-4c95-b8d1-2a6f9e4c5b7d
status: experimental
description: Detects HTTP requests to ServiceNow application endpoints containing SQL injection probe patterns (UNION SELECT, boolean-based probes, database error elicitation) in web access or reverse proxy logs, consistent with exploitation attempts against the SQL injection flaws in the ServiceNow AI Platform.
references:
  - https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/07
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri_host:
    cs-uri-stem|contains:
      - '/api/now'
      - 'sysparm'
      - '.do'
      - '/nav_to.do'
  selection_sqli:
    cs-uri-query|contains:
      - 'union select'
      - 'union all select'
      - ' or 1=1'
      - '\' or \'1\'=\'1'
      - 'extractvalue('
      - 'updatexml('
      - 'concat(0x'
      - 'information_schema'
      - 'sleep('
      - 'benchmark('
      - 'load_file('
  condition: selection_uri_host and selection_sqli
falsepositives:
  - Authorized vulnerability scanners and DAST tools — correlate source IPs against approved scanner ranges
  - Web application firewall tuning traffic
level: high
---
title: Outbound Network Connection From ServiceNow Application Process
id: 7d3a9f52-1c84-4b27-9e6a-8f5d1c3a9b2e
status: experimental
description: Detects the ServiceNow Java/Tomcat application process initiating outbound network connections to non-standard destinations, which may indicate command-and-control or data exfiltration following compromise of a self-hosted instance.
references:
  - https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/07
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071
  - attack.t1105
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|contains:
      - '/java'
      - 'tomcat'
  filter_known_dest:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_process and not filter_known_dest
falsepositives:
  - Legitimate ServiceNow cloud connectivity (instances phone home to ServiceNow infrastructure) — baseline destination ASNs and domains for your instance and alert on novel destinations
  - Third-party integrations and webhooks
level: medium

// Hunt for SQLi probes and anomalous unauthenticated request patterns against
// self-hosted ServiceNow instances in proxy/WAF logs ingested via CEF/Syslog.
// Adjust the DeviceHostName filter to your ServiceNow front-end / proxy hosts.
let servicenow_hosts = dynamic(["sn-proxy-01", "servicenow.example.com"]);
let sqli_patterns = dynamic([
  "union select", "union all select", " or 1=1", "extractvalue(",
  "updatexml(", "information_schema", "sleep(", "benchmark(",
  "concat(0x", "load_file("
]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceHostName in (servicenow_hosts) or DestinationHostName has_any (servicenow_hosts)
| extend Url = coalesce(RequestURL, AdditionalExtensions)
| where Url has_any (sqli_patterns)
   or (RequestMethod == "POST" and Url has_any ("/api/now", "sysparm", ".do")
       and RequestContext !has "session")  // candidate unauthenticated API hits
| summarize RequestCount = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            UniqueUrls = dcount(Url),
            SampleUrls = make_set(Url, 5)
  by SourceIP, SourceUserAgent, RequestMethod
| order by RequestCount desc;

// Companion hunt: Syslog from ServiceNow app servers showing the Java/Tomcat
// process spawning shells or download utilities (post-exploitation RCE).
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has_any ("java", "tomcat", "catalina")
   or SyslogMessage has ("servicenow")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "whoami", "nc -", "base64 -d")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

-- Artifact: SecurityArsenal.ServiceNow.PostExploitHunt
-- Hunts self-hosted ServiceNow application servers for post-exploitation
-- indicators: Java/Tomcat processes with suspicious children, recently
-- dropped files in Tomcat webroots (potential web shells), and
-- unexpected outbound connections from the application process.

-- 1. Java/Tomcat processes and their command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)java|tomcat|catalina'
   OR CommandLine =~ '(?i)servicenow|catalina'

-- 2. Recently modified files in Tomcat webroots (web shell candidates)
--    Adjust the glob path to your installation layout.
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/opt/tomcat/webapps/**/*.jsp',
  '/opt/*/webapps/ROOT/**/*.jsp',
  '/usr/share/tomcat*/webapps/**/*.jsp',
  '/srv/servicenow/**/webapps/**/*.jsp'
])
WHERE Mtime > (now() - 1209600)  -- modified in last 14 days
ORDER BY Mtime DESC

-- 3. Outbound connections from the Java application process
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)java'
  AND Status =~ 'ESTAB'
  AND NOT RemoteAddress =~ '^(10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|127\\.)'

#!/bin/bash
# servicenow_patch_verify.sh — Verify patch status and baseline posture
# for a self-hosted ServiceNow instance. Run on the application server
# or against the instance API with an admin credential.
#
# Usage:
#   ./servicenow_patch_verify.sh https://your-instance.example.com admin_user

set -euo pipefail

INSTANCE="${1:?Usage: $0 <instance_url> <username>}"
USER="${2:?Usage: $0 <instance_url> <username>}"

echo "[+] Querying instance build/version info..."
# The stats.do page exposes the current build tag and patch level.
curl -s -u "${USER}" "${INSTANCE}/stats.do" \
  | grep -iE 'build|version|patch|release' \
  | sed 's/<[^>]*>//g'

echo ""
echo "[+] ACTION REQUIRED: Compare the build tag above against the patched"
echo "    build listed in the ServiceNow security advisory for the AI Platform"
echo "    flaws (ServiceNow Support / HI portal). If your build predates the"
echo "    patched build for your release family, your instance is VULNERABLE."

echo ""
echo "[+] Checking local Tomcat webroot for recently modified JSP files"
echo "    (potential web shells — last 14 days)..."
for webroot in /opt/tomcat/webapps /usr/share/tomcat*/webapps /srv/servicenow/*/webapps; do
  if [ -d "${webroot}" ]; then
    find "${webroot}" -name '*.jsp' -mtime -14 -type f 2>/dev/null \
      | while read -r f; do
          echo "  RECENTLY MODIFIED: ${f} ($(stat -c '%y' "${f}"))"
        done
  fi
done

echo ""
echo "[+] Checking for shell/utility child processes of the Java/Tomcat process..."
JAVA_PIDS=$(pgrep -f 'java|catalina' || true)
if [ -n "${JAVA_PIDS}" ]; then
  for pid in ${JAVA_PIDS}; do
    children=$(ps --ppid "${pid}" -o pid=,comm= 2>/dev/null || true)
    if [ -n "${children}" ]; then
      echo "  Java PID ${pid} has child processes:"
      echo "${children}" | sed 's/^/    /'
    fi
  done
else
  echo "  No Java/Tomcat process found on this host (app tier may be elsewhere)."
fi

echo ""
echo "[+] Reviewing access logs for SQLi probe patterns (last 100k lines)..."
for log in /var/log/tomcat*/localhost_access_log*.txt /opt/*/logs/localhost_access_log*.txt /var/log/nginx/access.log /var/log/httpd/access_log; do
  if [ -f "${log}" ]; then
    hits=$(tail -n 100000 "${log}" | grep -icE 'union%20|union |select |sleep\(|benchmark\(|information_schema|extractvalue|updatexml' || true)
    if [ "${hits}" -gt 0 ]; then
      echo "  ${log}: ${hits} suspicious request(s) — investigate"
    fi
  fi
done

echo ""
echo "[+] Done. If any findings above are unexpected, preserve logs and"
echo "    escalate to IR before patching (patching can destroy evidence)."