New ServiceNow flaw lets attackers enumerate restricted data

A new vulnerability in ServiceNow, dubbed Count(er) Strike, allows low-privileged users to extract sensitive data from tables to which they should not have access. ServiceNow is a cloud-based platform that enables organizations to manage digital workflows for their enterprise operations. It is widely adopted across various industries, including public sector organizations, healthcare, financial institutions, and large enterprises. The flaw was discovered by Varonis Threat Labs in February 2024 and assigned the CVE-2025-3648 identifier, and may impact configurations with misconfigured or overly permissive ACLs. ServiceNow released additional access control frameworks in the Xanadu and Yokohama versions, released last month, to address the issue. However, all admins should review existing tables to ensure their data is properly locked down. ServiceNow utilizes Access Control Lists (ACLs) to restrict access to data within its tables. Each ACL evaluates four conditions when determining if a user should have access to a specific resource: For a user to gain access to a resource, all of these conditions must be satisfied. However, if a resource is protected with multiple ACLs, ServiceNow previously used an "Allow if" condition, meaning that if a user satisfied just one ACL, they could gain access, even if other ACLs would have blocked them. In some cases, this granted full access. However, in others, it allowed partial access, such as record counts that could be exploited, as expl...