Cleartext Credential Recovery in ServiceNow

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

TL;DR: This post explores using ServiceNow script includes to create a cleartext credential retrieval mechanism valid for any discovery credential type and LDAP credential records.

Introduction

ServiceNow is a cloud IT service management platform (ITSM) enabling enterprise scale asset tracking, workflow automation, and much more. I first leveraged ServiceNow on a red team assessment in 2024 to gather information for objective targeting through ServiceNow’s configuration management database (CMDB). A few months later, MDSec’s Tim Carrington (@__invictus_) published his Red Teaming with ServiceNow blog (which I recommend reading prior to continuing), opening my eyes to the myriad of other post-exploitation use cases possible through ServiceNow. This inspired me to dig into ServiceNow more at the annual SpecterOps hackathon earlier this year and hopefully this post will be the first of several stemming from that deep dive. One of the key questions I was hoping to answer was: can the server be influenced to return cleartext discovery credentials/secrets to the client? And particularly non-Windows credentials that aren’t susceptible to forced authentication coercion/relay vectors disclosed in Tim’s blog.

What are Discovery Credentials?

A prominent feature of ServiceNow is “Discovery” – basically asset discovery and inventorying workflows, which can optionally leverage credentials to remotely collect additional data (running processes, installed applications, bound ports, etc.) from live hosts. The web UI menu for adding a new credential contains 27 credential types (on a …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://specterops.io/blog/2026/08/27/cleartext-credential-recovery-servicenow/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.