And yet, it's leagues better than HP Service Manager or, heaven forbid, that ticket system someone created in Lotus Notes...
Ticket systems are always a giant pain.
ServiceNow Insecure Access Control to Full Admin Takeover
71–80 of 81 posts
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#72Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…
I couldn't agree more. But as others have said, it did replace some awful late 90s, early 2000s, software.
What's funny is that my dayjob became a re-seller for ServiceNow, and our ServiceNow install is terribly slow.
Then we have a major government client that we tried to sell ServiceNow to, but they decided on another re-seller. And I still have to work with this client as a consultant so I have to login to their separate ServiceNow setup, and wow is it faster! That other vendor that won the contract over us sure did a much better job at the setup than we ever did. (I was not involved in the re-selling or setup of ServiceNow at my dayjob, I only work in it as a user)
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#73Earlier quoted context omitted.
I recall that once upon a time, Service Manager was a client side app using the same GUI framework as Eclipse. Which made it very heavy, using tons of memory for an app that you only used now and then. I am not completely sure it was Service Manager, but quite sure. Then it was made a web app, 15+ years or so ago. Compared to that, ServiceNow is a dream to use.
The young pups here whining about ServiceNow have no idea. Service Manager, Remedy, etc were exponentially more miserable. I worked at a place that had 6 people who just twiddled Service Manager and kept the servers running etc. All ticketing systems suck. It’s the nature of the beast. People used to talk about how awesome JIRA is. Lol.
Personally, I think JIRA is awesome. I’ve seen the absolute disaster that is enterprise software and the cloud version of JIRA is not a disaster.
Everyone hates ticketing systems. But I think that’s because people hate spending time on things that aren’t relevant to them. They all get in the way of someone’s desired workflow. (Did I, a champion of organization, fill out my time sheet? No. No I did not. grumbles)
JIRA’s strength is being mediocre for just about everyone. No one’s workflow can be implemented 100%, but it can be customized enough for most purposes.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#74Earlier quoted context omitted.
It can really depend on the nature of the vulnerability and who discovered it. Based on the timeline at the bottom of this article it seems like this was way too slow. Based on the cve information this was ranked as 9.8. The last time I dealt with a bug that bad it was log4j. It was found on a Tuesday, patched on a Thursday, announced on a Friday, and I redeployed all of our servers over the weekend. The most egregio…
I suspect the CVSS score has been over-estimated. For the "scope" metric, the "vulnerable component" and the "affected component" are both ServiceNow itself, so that should be "unchanged": https://security.stackexchange.com/a/129205 That drops you down to an 8.8. Also, log4shell was a 10.0, which got that extra .2 points from not requiring any privs, whereas this ServiceNow vuln requires "low" privs.
Hi, ServiceNow dev here. I'd agree that the CVSS might be a little overinflated, but I don't think by much.
I would argue that ServiceNow as a singular component is flawed. It could be several applications on a single instance: Vulnerability Response, Security Incident Response, IT Service Management, IT Operations management, Vendor Risk Management, CMDB, etc.
I actually think in some instances, this vulnerability is considerably worse due the information it provides. User contact information, an inventory of the security vulnerabilities across the organization, applications & versions, Server information, etc. The social engineering issues are massive since they can spoof from essentially your service desk.
Often times ServiceNow has access to other subsystems. Midservers, provisioning tools, monitoring systems, desktop orchestration tools. These systems are often used to handle the response & monitoring. The ServiceNow teams are often understaffed and underskilled.
I've only been thinking about this for the last hour, but compromise 1 account (and I can think of at least 5 different ways that could happen) and a hacker could have:
- a complete topology of your infrastructure
- your active security vulnerabilities
- contact information for your entire company
- a very convincing spoofing method
- the ability to remotely install software on customer desktops
- the ability to monitor your response to security issues
- access to your provisioning tools
This kind of attack could go undetected for years. God forbid ServiceNow's internal instance got compromised. They can remote in to ANY instance.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#75Earlier quoted context omitted.
>> Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. Forget about their enterprise software, the very premise of the function they support is the thing I hate most. The software, the company, the consultants who push this garbage, the employees within your company who somehow have a named role implementing and managing it, I loathe it all.
interesting; curious - What is the thing you hate the most here? FWIW, I've been a kind of sysadmins for couple of decades, then ops manager for 5. After supporting multiple production streams, good and organized and consistent processes are an absolute must for me (as opposed to random wild west and utter chaos sometimes we techie prefer :-)). It is my understanding "premise of function they support" is organized wo…
The UI UX is hands-down the worst part. When a serious incident is opened and assigned to a team member the most efficient way to work it is to share around the link from the notification email as it can take more than 20 minutes to find it without a unique ID of the task or the assignee. The UI is full of unused links in my organization's implementation which makes this even more difficult as there is no hierarchy based on common or high use tasks. My favorite gripe is when resolving a task or incident the required notes for resolution are hidden under a tab somewhere in the middle of the page. Due to the counter-intuitive UI my team is often breaking process just to appease the SNOW workflow which in my organization leads to more tickets...
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#76Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…
I couldn't agree more. But as others have said, it did replace some awful late 90s, early 2000s, software. What's funny is that my dayjob became a re-seller for ServiceNow, and our ServiceNow install is terribly slow. Then we have a major government client that we tried to sell ServiceNow to, but they decided on another re-seller. And I still have to work with this client as a consultant so I have to login to their s…
One of ServiceNow’s biggest mistakes and greatest strengths is how much freedom it provides admins and devs to absolutely grind the instance to a halt.
Every shitty or slow ServiceNow instance I have seen in recent memory is because the customer is slugging along horrible code and poorly designed LCNC apps. A well managed instance can fly.
Not that the platform doesn’t have its problems of course. But most people’s experience with it is as the victim/end user of awful implementations.
My university used a resold white label instance from a consultant and that thing was an absolute disaster.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#77Earlier quoted context omitted.
It’s secret super power for executives is GQL it’s easier to use vs SQL and the interface looks slick compared to what’s out there. A very well architected instance looks and is pretty good, the issue is that often large enterprises will hire the cheapest possible consulting firm to implement it, and you can really screw it up if you’re not careful.
My background is ERP so that sounds similar then - the bones may be decent, but how you implement it can make or break it, both as IT exercise and as business transformation / process implementation; is that About right? I will likely have some input on how it's implemented and particularly the processes. I guess I should start reading up on best practices etc...
Yes, servicenow is much closer to an opinionated ERP vs a simple ITSM platform. In fact they’re working pretty hard on making it easier to implement your own erp type process in snow, instead of using it for only your item needs.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#78Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…
You should try out Cherwell, it’s so bad it’ll make you love ServiceNow.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#79Earlier quoted context omitted.
No, there isn’t. They all have pros and cons but none overall are “better”. ServiceNow is for large orgs with independent departments/orgs who need to use it differently. There’s BMC/Remedy but it’s just as convoluted and worse. Also Clarity used to be there. There are many that are better at one one or two specific functions, sure. But none that have all the added features a large mature org would need.
Comparing remedy and ServiceNow is a bit like comparing cable television with Netflix.
So an improvement?
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#80Almost exactly a year from report to disclosure. I'm sure it varies a lot, but is that a normal timeline for something this severe?
ServiceNow ships major upgrades twice a year and patches every month. It means that they could genuinely not figure out how to remediate this quickly and quietly without disrupting ongoing contract negotiations. It means that even with that, they couldn't fix it for a whole year. They negotiate multiyear contracts. they're investing into government and healthcare services.
I have to correct myself. Apparently the vulnerability was patched in San Diego patch 7 which was release on September 1st 2022. It wasn't disclosed until June 2023.
I am still mad they didn't release it as a hotfix, but that meant they couldn't sneak it under the radar.