Listen to this Post
Introduction
A single misconfigured checkbox in a ServiceNow Scripted REST Resource—requires_authentication=false—allowed attackers to query sensitive corporate data across multiple customer instances without any credentials. The attack, which began as early as April 2026 but was only publicly disclosed on June 9, saw threat actors targeting the `/api/now/related_list_edit/create` endpoint from IP 51.159.98.241, successfully extracting data from system tables containing IT tickets, employee records, and even security incident reports. What makes this incident particularly alarming is not just the unauthenticated access, but that ServiceNow allegedly knew about the issue months before patching it—and the company has yet to confirm whether customer data was actually exfiltrated.
Learning Objectives
- Understand how a misconfigured `requires_authentication` flag on a Scripted REST endpoint enables unauthenticated data exfiltration.
- Master forensic log analysis techniques to detect unauthorized `/api/now/related_list_edit` calls on both Linux and Windows systems.
- Implement credential rotation, API hardening, and continuous monitoring to mitigate similar SaaS API vulnerabilities.
You Should Know
- Logging the Unlogged: How to Hunt for Guest Activity in ServiceNow
The attacker’s requests appear in transaction logs attributed to the “Guest user” because the endpoint simply didn’t require authentication—there was no account to log against. Without REST message logging enabled beforehand, you can see the IP and timestamp, but not the request body or response payload that would confirm data theft. To determine if your instance was compromised, immediately audit the Transaction Log (/syslog_transaction.list), filtering for the vulnerable endpoint:
Step 1: Navigate to System Logs > Transactions. Step 2: Filter for the URL field containing “/api/now/related_list_edit”. Step 3: Add a second filter for “User” equals “Guest”. Step 4: Look for timestamps between April and June 2026. Step 5: Specifically search for the IP address “51.159.98.241”.
For Linux environments parsing exported logs via grep:
Extract all related_list_edit hits from raw transaction export grep -i "related_list_edit" /var/log/servicenow/transactions.log | grep "51.159.98.241"
For Windows (PowerShell) when analyzing exported CSV logs:
Import-Csv .\transactions.csv | Where-Object { $<em>.URL -like "related_list_edit" -and $</em>.SourceIP -eq "51.159.98.241" } | Format-Table
Administrators who find hits should immediately assume that sensitive records, including API tokens stored in support tickets, may have been accessed.
- Rotating the Hidden Keys: Credential and Token Rotation in ServiceNow
Since support tickets frequently contain plaintext credentials and API secrets, the second critical step is to rotate every credential that ever appeared in a workflow involving the vulnerable endpoint. ServiceNow recommends rotating credentials or tokens shared through support workflows, even if exfiltration is unconfirmed. Here is a step-by-step guide for forced rotation:
- Identify exposed credentials: Audit all tickets that were accessed during the suspicious time window. Look for API keys, basic auth passwords, OAuth refresh tokens, and any integration secrets.
2. Initiate rotation in ServiceNow:
- For OAuth keys: Navigate to
System OAuth > Application Registry. For each OAuth client that may have been exposed, revoke existing tokens via `sys_auth_token_oauth.list` and generate a new client secret. - For Basic Auth users: Force a password change via `User Administration > Users` and ensure the affected user accounts are tagged for re-authentication.
- Implement automated rotation: Configure a credential rotation policy using ServiceNow’s Credential Rotation module or integrate with an external secrets manager like HashiCorp Vault or CyberArk.
- Validate revocation: After rotation, test all downstream integrations to ensure old credentials no longer work.
- Enable logging for future rotations: Turn on REST message logging in the instance properties to capture request bodies for any future API calls.
3. Hardening the Gateway: Securing Scripted REST Resources
The root cause of this breach was a Scripted REST Resource with `requires_authentication` set to false. Many administrators mistakenly believe that toggling this checkbox is sufficient, but there is a separate checkbox for ACL enforcement. An endpoint can require authentication while still bypassing row-level security, allowing an authenticated-but-unauthorized user to pull data they should not see. To properly secure Scripted REST endpoints:
- Audit all Scripted REST Resources: Navigate to
System Web Services > Scripted REST APIs > Scripted REST Resources. - Inspect each resource’s properties: Verify that the “Requires authentication” checkbox is checked and the “Enforces ACLs” checkbox is also checked.
- Test with low-privilege accounts: Use a REST client (e.g., Postman or
curl) to attempt calls to the endpoint with a valid but low-privilege token. Confirm that access is denied. - Review resources that have not been updated since 2018—they likely contain outdated security defaults.
- Apply the principle of least privilege: Use OAuth with specific scopes rather than basic authentication, and never rely on obfuscation as a security control.
Example `curl` command to test authentication requirements:
This should fail if authentication is required curl -X GET https://yourinstance.service-1ow.com/api/now/related_list_edit/create \ -H "Accept: application/json" This should succeed for an authorized user curl -X GET https://yourinstance.service-1ow.com/api/now/related_list_edit/create \ -H "Accept: application/json" \ -H "Authorization: Bearer <valid_oauth_token>"
- Cloud Hardening: Applying the Lessons to Other SaaS APIs
This incident is not an isolated case. Similar misconfigurations have been found in Salesforce and Power Pages, where unauthenticated API endpoints or misconfigured guest user profiles allowed data access. To systematically harden your enterprise SaaS API landscape:
- Inventory all guest-accessible resources: For each SaaS platform, generate a report of all API endpoints that do not require authentication.
- Implement rate limiting: In ServiceNow, use “Rate Limit Rules” (available via the navigation menu) to control call frequency and limit the blast radius of any unauthenticated endpoint.
- Deploy a Web API monitoring dashboard: ServiceNow’s “Web API Usage Overview” provides a holistic view of all incoming API requests and can surface anomalies like bursts of `related_list_edit` calls.
- Use cloud security posture management (CSPM) tools that can automatically detect misconfigured endpoints across your entire SaaS estate.
- Establish a quarterly external attack surface assessment that specifically probes for unauthenticated API access.
-
The Silent Patch: Lessons from ServiceNow’s Disclosure Failure
ServiceNow applied a security patch on June 5, 2026, but did not publicly disclose the incident until June 9—and even then, the advisory was hidden behind a customer support login portal. For security teams, this underscores the importance of independent log monitoring and external threat intelligence. Organizations should:
- Never rely solely on vendor notifications. Assume any sensitive API endpoint could be compromised without notification.
- Subscribe to third-party security advisories and monitor Reddit and other community forums for early indicators of compromise.
- Build internal detection rules for anomalous API patterns, such as a high volume of guest-authenticated requests to non-public endpoints.
- Enable verbose logging by default for all REST APIs, even if it impacts performance. Without the request body and response payload, breach confirmation is impossible.
-
Linux and Windows Commands for Forensic Log Analysis
For organizations that have exported their ServiceNow logs to on-premises SIEM systems, the following commands are essential:
Linux (grep/awk):
Find all related_list_edit hits from the malicious IP zgrep -h "51.159.98.241" /var/log/servicenow/.log | grep -i "related_list_edit" > incident_hits.txt Extract all guest user transactions during the attack window (June 2-3) awk '/Guest/ && /2026-06-0[2-3]/' /var/log/servicenow/transactions.log > guest_activity.log Count unique table accesses from the API calls grep -oP '"table":"[^"]"' incident_hits.txt | sort | uniq -c | sort -1r
Windows (PowerShell):
Search for the malicious IP across all transaction logs
Get-ChildItem -Path "C:\Logs\ServiceNow\" -Recurse | Select-String -Pattern "51.159.98.241" | Out-File -FilePath malicious_ip_hits.txt
Filter for guest user transactions on June 2-3, 2026
Get-Content .\transactions_20260602.csv | Where-Object { $_ -match "Guest" } | Where-Object { $_ -match "2026-06-0[2-3]" } | Export-Csv -Path guest_activity.csv
Group by the accessed table to identify targeted data
Import-Csv .\incident_hits.csv | Group-Object table | Select-Object Name, Count | Sort-Object Count -Descending
What Undercode Say:
- Key Takeaway 1: The ServiceNow breach proves that a single misconfigured checkbox in a low-code environment can lead to massive data exfiltration. Organizations must shift from reactive patching to proactive API hardening, treating every REST endpoint as a potential attack surface.
- Key Takeaway 2: Vendor silence is not security. ServiceNow’s decision to hide the advisory behind a login portal and not publicly disclose the attack window undermines trust. Security teams must build detection capabilities that operate independently of vendor notifications, including monitoring for guest-activity anomalies and maintaining forensic readiness through mandatory REST logging.
Prediction:
- -1 The lack of transparency around the full scope of this breach, combined with ServiceNow’s admitted knowledge of the vulnerability in April, will likely trigger regulatory investigations in the EU and California. Expect fines under GDPR and CCPA, particularly if stolen data included EU citizen records.
- +1 This incident will accelerate the adoption of API security posture management (ASPM) tools that automatically scan for unauthenticated endpoints and enforce “authentication-by-default” policies. By 2027, major cloud providers will likely mandate API security audits as a condition for compliance certifications.
- -1 The credential rotation burden will overwhelm understaffed security teams, leading to “rotation fatigue” where some organizations skip verification steps, leaving backdoors open. Attackers will increasingly pivot to targeting support tickets as a primary credential harvesting method.
- +1 The breach will spark the development of open-source tooling specifically designed to audit ServiceNow instances for misconfigured Scripted REST Resources, democratizing security assessment for smaller enterprises that cannot afford commercial solutions.
- -1 Legacy instances running the Australia platform release or older versions with custom modifications will remain vulnerable for months, as many organizations delay applying the patch out of fear of breaking custom workflows. Expect follow-on exploitation attempts targeting unpatched instances.
▶️ Related Video (86% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Daniel Scheidt – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
