In response to the recently published "Simple-List-Widget Attack", I have created a Scoped Application that allows you to analyse any (still) existing problematic Widgets and ACLs.

In addition you can systematically analyse the data extraction attempts.

Disclaimer:

This application adheres to data protection regulations and processes all data locally. The app exclusively uses data from the instance on which it is installed and does not disclose any data from that instance.
Note: 4 custom tables are used by this application. After the incident has been resolved and closed, please uninstall the application (see instructions in the next post).

The Application can be installed via the following repository:

https://github.com/kr4uzi/ServiceNow-Data-Leak-Analyser

Note: Install Instructions are in the first reply to this post.

Planned Features:

- Full Leak Analysis (Which records have been actually transmitted to an attacker)
(Implemented in Version 1.1.0)

- Management Summary ("C-Level Summary of this Incident")

Features:

1.) Analyse potentially leaking Widget

- Create a Task for each detected, potentially leaking (public) Widget

- Provide remediation instructions in the Dashboard and the Task to close the security gap

- Recommended: Analysis should be done repeatedly via "Re-Analyse Widgets"

2.) Analyse ACLs

- Show ACLs prone for leaking data

- Lists ServiceNow Best Practices and instruction to harden the ACL configuration

3.) Analyse Extraction Attempts

- Analyse all extraction attempts and show informations about the attack

- Analyse which records have been leaked

- Creates a task for each attempt to document the your analysis

Show all the information required to analyse the Extraction Attempt in the Task itself:

Please see the very first response to this Post for Installation & Update Instructions.