Snowpick Tool Exposes Widespread Data Exposure in ServiceNow Instances
An open-source tool developed by Bishop Fox, Snowpick, has revealed that 31% of tested ServiceNow instances exhibit data exposure vulnerabilities, allowing unauthorized access to sensitive information.
Bishop Fox has released Snowpick, an open-source Go tool designed to scan ServiceNow instances for potential data exposure. The tool was developed and utilized during authorized penetration tests, where it identified significant configuration and access control issues across numerous ServiceNow deployments. The findings indicate that a substantial portion of these widely used enterprise platforms are susceptible to unauthorized data retrieval through their public-facing Service Portals.
During testing of 166 ServiceNow instances, Snowpick discovered that 31% of them were vulnerable, exposing sensitive records to unauthenticated users. These exposures were not due to novel zero-day exploits but rather misconfigurations in access controls on public ServiceNow surfaces, such as the Service Portal's knowledge base and ticket submission features. The tool's analysis traced these vulnerabilities to approximately three-quarters of the organizations included in the test dataset, highlighting the broad impact of these security weaknesses.
ServiceNow instances handle data through two primary surfaces: Service Portal widgets and the Table REST API. Widgets, accessible via URLs like /api/now/sp/widget/{widget_id}, are used for knowledge base searches, catalog pages, and ticket forms. The Table REST API, located at /api/now/table/{table_name}, allows direct queries to various tables, including user and incident data. Each surface has its own access control mechanisms, and an instance might secure its widgets while leaving its Table REST API exposed, or vice versa.
The most common vector for data exposure identified by Snowpick was the ticket-attachments widget. This stock widget, when misconfigured, can reveal metadata about files attached to tickets. This metadata often contains sensitive internal information, such as onboarding guides, access request procedures, and system how-to documents. Beyond attachments, exposed data included knowledge base articles, incident ticket metadata, service catalog items, and details about organizational structures and facility locations.
Snowpick operates by first retrieving the public login page of a ServiceNow instance to obtain a session token. This token is then reused for subsequent API calls to probe various default widgets and common table/field pairs. The tool can also dynamically discover and test custom widgets installed on an instance. It differentiates between direct row exposure and a 'count oracle' scenario, where the instance confirms the existence of records but returns none, a behavior previously tracked as CVE-2025-3648.
Bishop Fox decided to release Snowpick publicly to enhance defender visibility and encourage remediation. The company argues that the techniques used to find these exposures were already public knowledge, and keeping the tool internal would only hinder legitimate security assessments. By making Snowpick available, they aim to empower organizations to identify and fix these configuration flaws before they can be exploited by malicious actors.
Remediation for these exposures involves a multi-faceted approach. Organizations must review and secure public Service Portal widgets that might return sensitive data, such as ticket details, attachments, or catalog information. Additionally, a thorough audit of table-level, field-level, and row-level Access Control Lists (ACLs) is crucial. Even widgets that appear secure on direct load can sometimes be accessed indirectly through other widgets, necessitating a comprehensive security review.
Ultimately, addressing these vulnerabilities is a shared responsibility between ServiceNow and its customers. While ServiceNow can implement platform-level safeguards and best practices for public widgets and table access, customers must actively test their own public-facing instances from an external perspective. Snowpick provides a valuable, free resource for organizations to conduct these critical security checks and protect their sensitive data.