Critical Remote Code Execution Vulnerability (CVE‑2024‑5217) in ServiceNow Now Platform Allows Unauthenticated Code Execution
What It Is – ServiceNow’s Utah, Vancouver, and Washington DC releases of the Now Platform contain an incomplete list of disallowed inputs in the GlideExpression script. An attacker can supply a crafted payload that bypasses the filter and executes arbitrary code on the server.
Exploitability – The flaw is exploitable without authentication (remote code execution). A proof‑of‑concept exists in the public advisory; no known active exploit campaigns have been reported yet.
Affected Products – ServiceNow Now Platform (versions released under the Utah, Vancouver, and Washington DC code‑names).
Why It Matters for Trust & Control Assurance
- Control Objective – Secure Development & Configuration Management – The vulnerability shows a gap in input‑validation controls, a control area referenced across SOC 2, ISO 27001, NIST CSF 2.0 and others.
- Continuous Evidence – Demonstrating that you have a documented, tested input‑validation process and that patches are applied promptly provides defensible audit evidence.
- Enterprise Buyer Expectation – Large customers now demand proof that SaaS providers enforce robust code‑execution safeguards; a missing control can stall contracts or trigger additional due‑diligence.
Recommended Actions
- Apply ServiceNow’s patch for CVE‑2024‑5217 immediately.
- Conduct a focused review of all custom scripts and integrations for similar input‑validation gaps.
- Update your secure‑development policy to include automated testing for disallowed‑input lists.
- Capture remediation evidence (patch tickets, test results) in your control‑monitoring repository for audit readiness.
Source: CISA KEV – CVE‑2024‑5217