ServiceNow Vulnerability Exposes Sensitive Data To Low-Privilege Users

Uploaded on 2025-07-10 in TECHNOLOGY-Key Areas-Artificial Intelligence, NEWS-Cybersecurity News, FREE TO VIEW

A critical data inference vulnerability, dubbed “Count(er) Strike,” has been uncovered in ServiceNow, the world’s leading IT Service Management (ITSM) platform, according to a report by Varonis Systems,

The flaw, identified by Varonis’ threat research team, allows users with low-level permissions to extract sensitive information from restricted tables, potentially compromising business-critical data.

With ServiceNow handling vast amounts of sensitive information across IT operations, human resources, and portfolio management for thousands of global enterprises, this vulnerability poses a significant risk.

The report details the nature of the exploit, its implications, and urgent recommendations for mitigation, highlighting the need for robust data security measures in cloud-based platforms.

Understanding the Count(er) Strike Vulnerability

The Count(er) Strike vulnerability exploits ServiceNow’s “count” function, which allows users to query the number of records in a table. While seemingly innocuous, this function can be manipulated by low-privilege users to infer sensitive data from tables they lack direct access to.

Varonis’ researchers demonstrated that attackers can craft queries to deduce record contents, such as user credentials or financial details, by leveraging patterns in the count responses. This data inference technique bypasses ServiceNow’s access controls, turning a routine feature into a potential backdoor for unauthorised data extraction.

The report notes that the vulnerability affects multiple ServiceNow versions, though specific versions were not disclosed to prevent exploitation before patches are applied.

Scope & Impact

ServiceNow’s extensive use across industries makes this vulnerability particularly concerning. The platform processes sensitive data, including personal identifiable information (PII), financial records, and operational logs, making it a prime target for cyberattacks. The report warns that attackers could exploit Count(er) Strike to extract regulated data, such as that governed by GDPR, CCPA, or HIPAA, potentially leading to compliance violations and hefty fines.

For instance, a malicious actor with basic access could infer employee records or customer data, enabling phishing campaigns, identity theft, or insider threats. Posts on X have echoed this concern, noting the vulnerability’s potential to expose sensitive tables, amplifying the urgency for organisations to act swiftly.

The report also highlights ServiceNow’s customization capabilities as a double-edged sword. While these features enable tailored workflows, they often lead to misconfigured access controls, exacerbating vulnerabilities like Count(er) Strike.

Varonis estimates that thousands of organisations worldwide, including major enterprises, could be affected, given ServiceNow’s dominance in the ITSM market. The lack of immediate public disclosure from ServiceNow about the vulnerability’s scope adds to the uncertainty, leaving organisations to rely on proactive security measures to protect their data.

Varonis’ Role In Mitigation

Varonis’ Data Security Platform, which integrates with ServiceNow, played a pivotal role in identifying the vulnerability. The platform’s ability to automatically discover and classify sensitive data across structured and unstructured sources - such as ServiceNow’s fields, tables, logs, and attachments - enabled researchers to pinpoint the exploit. Varonis’ granular audit trails and risk analysis tools detected abnormal query patterns, revealing the potential for data inference.

The report emphasizes that Varonis’ integration with ServiceNow allows organisations to streamline remediation by creating tickets directly within the platform, addressing misconfigurations and overexposures in real time. This capability is critical for mitigating risks posed by Count(er) Strike and similar vulnerabilities.

Recommendations For Organisations

To counter the threat, Varonis urges ServiceNow users to take immediate action.

First, organisations should review and tighten access controls, ensuring that low-privilege users cannot exploit the count function to infer sensitive data. The report recommends leveraging Varonis’ platform to monitor data activity and detect anomalous queries, which can indicate potential exploits.

Additionally, enterprises should apply ServiceNow’s latest patches and updates, as the company is likely working on a fix following Varonis’ responsible disclosure.

Regular audits of ServiceNow configurations are also essential to identify and remediate misconfigurations that could amplify the vulnerability’s impact.

The report further advises integrating advanced data security solutions to provide a unified view of sensitive data across cloud and on-premises environments.

This approach enables organisations to contextualize ServiceNow data within their broader ecosystem, identifying risks like public access to sensitive tables or shadow admin accounts. For long-term resilience, businesses should prioritize employee training on secure configuration practices and establish robust incident response protocols to handle potential breaches swiftly.

Call To Action

The Count(er) Strike vulnerability shows the fragility of even the most widely used enterprise platforms. As cyberattacks grow more sophisticated, the report serves as a wake-up call for organisations to move beyond traditional security approaches. Varonis’ Field CTO, Brian Vecci, emphasizes that “piecemeal security approaches create vulnerabilities that attackers can exploit.”

By adopting automated, AI-driven solutions, enterprises can stay ahead of threats like Count(er) Strike, according to Vecci.

The incident also highlights the importance of responsible disclosure and collaboration between security vendors and platform providers to protect critical data. As organisations await further guidance from ServiceNow, proactive measures remain their best defence against this emerging threat.

Image: @ServiceNow

You Might Also Read:

Do You Need Security That Starts With “Prove It”?:

If you like this website and use the comprehensive 8,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.