Critical Jelly Template Injection (CVE‑2024‑4879) in ServiceNow Utah, Vancouver, and Washington DC Platforms Enables Unauthenticated Remote Code Execution
What It Is – ServiceNow’s Utah, Vancouver, and Washington DC Now Platform releases contain a jelly‑template injection flaw in UI macros. An attacker can supply crafted input that the platform renders without proper sanitisation, leading to remote code execution.
Exploitability – The vulnerability is exploitable without authentication. Public proof‑of‑concept code has been released, and the CVSS score assigned by NVD is 9.8 (Critical).
Affected Products – ServiceNow Now Platform (versions released for the Utah, Vancouver, and Washington DC releases).
Why It Matters for Trust & Control Assurance
- Application‑level input validation is a core control objective; a failure here undermines the “secure development” and “protect data” pillars that map to many frameworks (e.g., NIST CSF PR.DS‑1, ISO 27001 A.14.2).
- Enterprise buyers increasingly demand continuous evidence that third‑party SaaS providers remediate critical flaws promptly, turning patch status into a measurable trust signal.
- Demonstrable vendor risk monitoring shows due‑diligence in audit trails and satisfies regulator‑focused inquiries about supply‑chain security.
Recommended Actions
- Apply ServiceNow’s security patch for CVE‑2024‑4879 immediately.
- Verify the patch deployment through automated configuration scanning.
- Update your third‑party risk program to include real‑time monitoring of vendor vulnerability feeds.
- Document the remediation in your control evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2024‑4879