Snowpick: Open-Source Scanner Exposes Widespread Unauthenticated Data Leakage in ServiceNow Instances (CVE-2025-3648 "Count(er) Strike" Context)

Snowpick: Open-Source Scanner Exposes Widespread (TL-2026-1604), also tracked as Count(er) Strike, is a medium-severity software vulnerability scored CVSS 8.2, first published 2026-07-22. It has no confirmed attribution, affects ServiceNow Now Platform, references 1 CVE (CVE-2025-3648), maps to 21 MITRE ATT&CK techniques (T1069, T1078, T1083), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1604

Threat ID
TL-2026-1604
Also known as
Count(er) Strike, Snowpick ServiceNow Exposure Scanner
Severity
MEDIUM
CVSS
8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-22
Last reviewed
2026-07-22
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, manufacturing, retail, energy, telecoms, education, professionalservices
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in Snowpick: Open-Source Scanner Exposes Widespread

Malware and tooling: Snowpick

Bishop Fox released Snowpick, an open-source Go tool that probes ServiceNow Service Portal widgets and the Table REST API for unauthenticated data exposure; testing 166 real-world instances found 31% (52 instances) leaked sensitive records, affecting roughly 75% of the organizations tested. The release follows and operationalizes prior Varonis Threat Labs research into CVE-2025-3648 ("Count(er) Strike"), a data-inference flaw in ServiceNow's Access Control List (ACL) evaluation that lets authenticated and unauthenticated users infer restricted record data via crafted range/count queries.

How Snowpick: Open-Source Scanner Exposes Widespread works

Bishop Fox adversarial operator Emilio Gallegos published Snowpick, a Go-based reconnaissance and exposure-testing tool that simulates an unauthenticated visitor to a public-facing ServiceNow Service Portal. Snowpick requests the public login page to extract a valid ServiceNow session token and cookies, then reuses that unauthenticated session against two distinct API surfaces: the Service Portal Widget API (`/api/now/sp/widget/{widget_id}`), which backs knowledge-base search, catalog browsing, ticket forms, and file/attachment views, and the Table REST API (`/api/now/table/{table_name}`), which queries database tables directly (e.g. sys_user, incident, kb_knowledge, oauth_entity). The tool probes a curated list of default/built-in widgets (ticket-attachments, kb-article-page, kb-search, kb-category-list, sc-category, simple-list, widget-simple-list) plus 26 built-in table/field combinations spanning users, incidents, departments, companies, assets, attachments, catalog items, customer records, and operational tasks, and can additionally query the target instance for which widgets are installed to extend probing to custom, org-specific widgets. Findings are classified as exposed (records/evidence fields returned), count_oracle (ServiceNow confirms matching records exist without returning rows), or not_exposed, with structured JSON output and reproduction-ready curl commands plus heuristic impact hints (PII, credentials, infrastructure, internal operations).

Across 166 ServiceNow instances tested with authorization, 31% (52 instances) returned at least one exposed or count_oracle finding, and roughly three-quarters of the organizations represented in the dataset had at least one affected instance. The ticket-attachments widget was the dominant exposure vector; two instances leaked no data via widgets but were exposed through the raw Table REST API instead. Exposed data included attachment titles/descriptions revealing internal business processes, knowledge base articles, incident ticket metadata, service catalog items, department structures, and facility locations, with record counts per finding ranging from dozens to thousands. No credentials were observed in this specific dataset, though Snowpick's classification scheme explicitly tracks credential exposure as a possible impact category.

Snowpick's release builds on and operationalizes the underlying access-control weakness class documented by Varonis Threat Labs as CVE-2025-3648, nicknamed "Count(er) Strike" (CWE-1220, CVSS v4.0 8.2 HIGH: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). ServiceNow's ACL engine evaluates access in a four-stage hierarchy — required roles, security attribute conditions, data conditions, and script conditions — where an empty condition at any stage is treated as unrestricted. When only the data/script condition stages carry restrictions, a failed check does not fully block the request: ServiceNow's list-page UI still surfaces the total record count plus a "Number of rows removed from this list by Security constraints" message. Attackers abuse this residual signal by appending crafted sysparm_query filters (STARTSWITH, CONTAINS, EQUALS, range comparisons, boolean AND/OR combinators) to binary-search field values one character or condition at a time — a classic blind/count-based inference (side-channel) attack — and can pivot across tables via dot-walking on reference fields to reach data not directly exposed by the vulnerable table's own ACLs. Varonis discovered and privately disclosed the flaw to ServiceNow in February 2024; ServiceNow shipped a security update in May 2025 and the CVE was formally assigned on July 8, 2025. ServiceNow's remediation introduced three new access-control primitives: Query ACLs (with query_range operations restricting dangerous operators like STARTSWITH/CONTAINS/range comparisons, and query_match operations permitting only safe exact-match operators such as EQUALS/IN/ISNULL), Security Data Filters (post-ACL filtering that also suppresses the "rows removed" leak message), and a new Deny-Unless ACL type requiring ALL deny-unless conditions to be satisfied in addition to existing allow-if conditions, closing the single-ACL-pass-grants-access loophole. No pre-patch in-the-wild exploitation of CVE-2025-3648 has been confirmed, but with ~85% of Fortune 500 companies running ServiceNow, self-registration enabled on some public portals, and a free, purpose-built open-source scanner (Snowpick) now published, the exploitation likelihood against unremediated/misconfigured instances has materially increased. Gallegos framed the public release as a defender-empowerment decision: keeping the tool internal would not slow motivated attackers, only the defenders responsible for these systems.

MITRE ATT&CK techniques used in TL-2026-1604

Discovery

T1069 Permission Groups Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Defense Evasion

T1078 Valid Accounts

Collection

T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

lateral-movement

T1550 Use Alternate Authentication Material

Impact

T1565 Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information; T1595 Active Scanning; T1596 Search Open Technical Databases

Affected products and versions in Snowpick: Open-Source Scanner Exposes Widespread

  • ServiceNow — Now Platform
    Vulnerable versions: Instances with pre-May 2025 security update and misconfigured ACLs (empty Required Roles / Security Attribute Condition, restrictions only at Data/Script Condition level)
    Fixed in: Instances with May 2025 ServiceNow security update applied and Query ACLs / Security Data Filters / Deny-Unless ACLs configured on sensitive tables

Remediation for Snowpick: Open-Source Scanner Exposes Widespread

Patches

  • Apply the ServiceNow security update released May 2025 addressing CVE-2025-3648 (Now Platform)
  • Reference ServiceNow KB articles KB2046494, KB2139567, and KB2256712 for patch and configuration guidance

Immediate actions

  • Run Snowpick (or an equivalent authenticated review) against every public-facing ServiceNow Service Portal instance you own to identify exposed widgets and tables
  • Review all public Service Portal widgets for unauthenticated access, especially those returning ticket, attachment, knowledge base, catalog, or list data
  • Review Table REST API access separately from widget access, since the two surfaces do not enforce ACLs identically
  • Audit ACL configurations for tables carrying sensitive data where Required Roles and Security Attribute Condition fields are empty and only Data/Script Conditions are set
  • Disable ServiceNow self-registration on public portals unless explicitly required for business operations
  • Restrict or disable dot-walking on sensitive reference fields to prevent cross-table pivoting

Workarounds

  • Where patching/upgrading is delayed, manually add Security Data Filters to suppress count/rows-removed messages on sensitive tables
  • Temporarily restrict anonymous/public access to Service Portal widgets identified as exposed by Snowpick or manual testing
  • Disable or restrict the ticket-attachments widget on public portals, the dominant exposure vector observed in Bishop Fox's dataset

Longer-term hardening

  • Apply ServiceNow's Query ACLs (query_range and query_match operations) to all tables containing PII, credentials, PHI, or proprietary data
  • Implement Security Data Filters on critical tables to suppress the record-count/'rows removed by security constraints' information leak
  • Migrate sensitive-table ACLs to the Deny-Unless ACL type so all deny conditions must be satisfied in addition to allow conditions
  • Establish periodic (e.g. quarterly) external unauthenticated testing of public ServiceNow portals as part of continuous SaaS security posture management
  • Monitor for automated enumeration patterns (repeated sysparm_query requests with incrementally modified filters/range operators) against list pages and the Table REST API

CVEs associated with Snowpick: Open-Source Scanner Exposes Widespread

CVE-2025-3648

Weaknesses (CWE) in Snowpick: Open-Source Scanner Exposes Widespread

CWE-1220

Timeline of Snowpick: Open-Source Scanner Exposes Widespread

  • Security researcher Aaron Costello publishes original research on the widget-simple-list unauthenticated-exposure technique in ServiceNow, foundational to later Snowpick methodology.
  • Varonis Threat Labs discovers the ACL data-inference weakness (later named 'Count(er) Strike') and privately discloses it to ServiceNow.
  • ServiceNow releases a security update introducing Query ACLs, Security Data Filters, and Deny-Unless ACLs to remediate the data-inference weakness.
  • CVE-2025-3648 formally assigned to the ServiceNow ACL data-inference vulnerability.
  • Varonis Threat Labs and multiple outlets (The Hacker News, SC Media, others) publicly detail CVE-2025-3648 'Count(er) Strike' and ServiceNow's mitigation framework.
  • Help Net Security publishes coverage of the Snowpick release and exposure statistics, referencing CVE-2025-3648 as related prior research.
  • Bishop Fox discloses that authorized testing across 166 ServiceNow instances found 31% (52 instances) exposing sensitive data without authentication, affecting roughly 75% of tested organizations.
  • Bishop Fox publicly releases Snowpick, an open-source Go scanner for unauthenticated ServiceNow data exposure across Service Portal widgets and the Table REST API.

Sources cited for Snowpick: Open-Source Scanner Exposes Widespread

Threats related to Snowpick: Open-Source Scanner Exposes Widespread

Detection coverage for TL-2026-1604

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1604 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats