Skip to navigation

Threat reportVulnerabilityTL-2026-1604

Snowpick: Open-Source Scanner Exposes Widespread Unauthenticated Data Leakage in ServiceNow Instances (CVE-2025-3648 "Count(er) Strike" Context)

mediumACTIVE

Bishop Fox released Snowpick, an open-source Go tool that probes ServiceNow Service Portal widgets and the Table REST API for unauthenticated data exposure; testing 166 real-world instances found 31% (52 instances) leaked sensitive records, affecting roughly 75% of the organizations tested. First disclosed .

Key facts for ServiceNow Count(er) Strike ACL leak

IdentifiersTL-2026-1604, CVE-2025-3648
Also known asCount(er) Strike, Snowpick ServiceNow Exposure Scanner
SeverityMEDIUM
CVSS8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
First disclosed
Exploitation statusPublic proof-of-concept exploit
EPSSCVE-2025-3648: 1.6% (74.1th percentile)
Affected productsServiceNow Now Platform
Weaknesses (CWE)CWE-1220
ToolsSnowpick
MITRE ATT&CK techniquesT1069 Permission Groups Discovery, T1078 Valid Accounts, T1083 File and Directory Discovery, T1087 Account Discovery, T1119 Automated Collection, T1190 Exploit Public-Facing Application, T1213 Data from Information Repositories, T1526 Cloud Service Discovery, T1528 Steal Application Access Token, T1530 Data from Cloud Storage, T1550 Use Alternate Authentication Material, T1552 Unsecured Credentials and 9 more in the attack flow
MotivationUNKNOWN
Target sectorsgovernment administration, finance, health, technology, manufacturing, retail, energy, telecoms, education, professionalservices
Target regionsNorth America, Europe, Global
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage for ServiceNow Count(er) Strike ACL leak

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1604 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unauthenticated ServiceNow Service Portal Widget Enumeration (Snowpick-style)

Detects a single unauthenticated client hammering the Service Portal Widget API (/api/now/sp/widget/{widget_id}) across multiple distinct widget IDs in a short window — the signature reconnaissance pattern of Snowpick and its predecessor 'widget-simple-list' technique used to probe for CVE-2025-3648 (Count(er) Strike) style ACL exposures.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1595, T1190, T1213
  • Data sources: servicenow_web_access_log, waf_http_logs, reverse_proxy_logs
  • Severity: high
  • Confidence: high

Splunk SPL

index=web sourcetype=servicenow:webserver cs_uri_stem="/api/now/sp/widget/*" c_authenticated=false
| eval widget_id=mvindex(split(cs_uri_stem,"/"),-1)
| bin _time span=5m
| stats dc(widget_id) as distinct_widgets, values(widget_id) as widgets, count as request_count by c_ip, _time
| where distinct_widgets >= 4 OR request_count >= 8
| sort -distinct_widgets

Microsoft KQL

let lookback = 24h;
ServiceNowWebLog
| where TimeGenerated > ago(lookback)
| where cs_uri_stem has "/api/now/sp/widget/"
| where c_authenticated == false
| extend WidgetId = tostring(split(cs_uri_stem, "/")[-1])
| summarize DistinctWidgets = dcount(WidgetId), Widgets = make_set(WidgetId), RequestCount = count() by c_ip, bin(TimeGenerated, 5m)
| where DistinctWidgets >= 4 or RequestCount >= 8
| project TimeGenerated, c_ip, DistinctWidgets, RequestCount, Widgets
| sort by DistinctWidgets desc

Sigma

title: Unauthenticated ServiceNow Service Portal Widget Enumeration (Snowpick-style)
id: 8f3c1b2e-1a4d-4e2a-9b3f-a1c2d3e4f501
status: experimental
description: Detects a single unauthenticated source enumerating multiple built-in Service Portal widgets, consistent with Snowpick's widget-exposure probing (CVE-2025-3648 context).
references:
    - https://github.com/BishopFox/snowpick
    - https://www.varonis.com/blog/counter-strike-servicenow
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.reconnaissance
    - attack.t1595
    - attack.t1590
    - cve.2025.3648
    - attack.tool.snowpick
logsource:
    category: webserver
    product: servicenow
detection:
    selection:
        cs-uri-stem|contains: '/api/now/sp/widget/'
        c-authenticated: false
    timeframe: 5m
    condition: selection | count(cs-uri-stem) by c-ip > 5
falsepositives:
    - Legitimate anonymous portal browsing at low volume
    - Load-testing or synthetic monitoring against the public portal
level: high

Known false positives:

  • Legitimate anonymous visitors browsing multiple public knowledge-base or catalog widgets in normal succession
  • Uptime/synthetic monitoring tools polling multiple public widgets

Tuning notes: Baseline normal anonymous-portal widget-view volume per organization before enabling alerting; raise distinct_widgets/request_count thresholds for high-traffic public portals and exclude known monitoring-service source IPs/user agents.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ServiceNow Table REST API Range-Query Inference Pattern (Count(er) Strike) · unlock with TL Creds
  • ServiceNow Dot-Walking Cross-Table Pivot via Reference-Field Query · unlock with TL Creds
  • Anonymous ServiceNow Session-Cookie Harvest Immediately Followed by Sensitive Table Access · unlock with TL Creds
  • Sigma: Automated Snowpick-style Scanner User-Agent/Timing Signature on ServiceNow · unlock with TL Creds
  • Sigma: ServiceNow Record-Count Security-Constraint Leak Response at Abnormal Frequency · unlock with TL Creds
  • Sigma: High-Volume Unauthenticated Exfiltration via Table REST API (Automated Collection) · unlock with TL Creds
  • ServiceNow [indicator] Widget Repeated Unauthenticated Access · unlock with TL Creds
  • Custom Widget Discovery via ServiceNow Portal Widget-List Enumeration · unlock with TL Creds

Indicators of compromise for ServiceNow Count(er) Strike ACL leak

As of 2026-07-22, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-1604.

18 indicators of compromise · unlock with TL Creds. Compare plans

How ServiceNow Count(er) Strike ACL leak works

The release follows and operationalizes prior Varonis Threat Labs research into CVE-2025-3648 ("Count(er) Strike"), a data-inference flaw in ServiceNow's Access Control List (ACL) evaluation that lets authenticated and unauthenticated users infer restricted record data via crafted range/count queries.

Bishop Fox adversarial operator Emilio Gallegos published Snowpick, a Go-based reconnaissance and exposure-testing tool that simulates an unauthenticated visitor to a public-facing ServiceNow Service Portal. Snowpick requests the public login page to extract a valid ServiceNow session token and cookies, then reuses that unauthenticated session against two distinct API surfaces: the Service Portal Widget API (`/api/now/sp/widget/{widget_id}`), which backs knowledge-base search, catalog browsing, ticket forms, and file/attachment views, and the Table REST API (`/api/now/table/{table_name}`), which queries database tables directly (e.g. sys_user, incident, kb_knowledge, oauth_entity). The tool probes a curated list of default/built-in widgets (ticket-attachments, kb-article-page, kb-search, kb-category-list, sc-category, simple-list, widget-simple-list) plus 26 built-in table/field combinations spanning users, incidents, departments, companies, assets, attachments, catalog items, customer records, and operational tasks, and can additionally query the target instance for which widgets are installed to extend probing to custom, org-specific widgets. Findings are classified as exposed (records/evidence fields returned), count_oracle (ServiceNow confirms matching records exist without returning rows), or not_exposed, with structured JSON output and reproduction-ready curl commands plus heuristic impact hints (PII, credentials, infrastructure, internal operations).

Across 166 ServiceNow instances tested with authorization, 31% (52 instances) returned at least one exposed or count_oracle finding, and roughly three-quarters of the organizations represented in the dataset had at least one affected instance. The ticket-attachments widget was the dominant exposure vector; two instances leaked no data via widgets but were exposed through the raw Table REST API instead. Exposed data included attachment titles/descriptions revealing internal business processes, knowledge base articles, incident ticket metadata, service catalog items, department structures, and facility locations, with record counts per finding ranging from dozens to thousands. No credentials were observed in this specific dataset, though Snowpick's classification scheme explicitly tracks credential exposure as a possible impact category.

Snowpick's release builds on and operationalizes the underlying access-control weakness class documented by Varonis Threat Labs as CVE-2025-3648, nicknamed "Count(er) Strike" (CWE-1220, CVSS v4.0 8.2 HIGH: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). ServiceNow's ACL engine evaluates access in a four-stage hierarchy — required roles, security attribute conditions, data conditions, and script conditions — where an empty condition at any stage is treated as unrestricted. When only the data/script condition stages carry restrictions, a failed check does not fully block the request: ServiceNow's list-page UI still surfaces the total record count plus a "Number of rows removed from this list by Security constraints" message. Attackers abuse this residual signal by appending crafted sysparm_query filters (STARTSWITH, CONTAINS, EQUALS, range comparisons, boolean AND/OR combinators) to binary-search field values one character or condition at a time — a classic blind/count-based inference (side-channel) attack — and can pivot across tables via dot-walking on reference fields to reach data not directly exposed by the vulnerable table's own ACLs. Varonis discovered and privately disclosed the flaw to ServiceNow in February 2024; ServiceNow shipped a security update in May 2025 and the CVE was formally assigned on July 8, 2025. ServiceNow's remediation introduced three new access-control primitives: Query ACLs (with query_range operations restricting dangerous operators like STARTSWITH/CONTAINS/range comparisons, and query_match operations permitting only safe exact-match operators such as EQUALS/IN/ISNULL), Security Data Filters (post-ACL filtering that also suppresses the "rows removed" leak message), and a new Deny-Unless ACL type requiring ALL deny-unless conditions to be satisfied in addition to existing allow-if conditions, closing the single-ACL-pass-grants-access loophole. No pre-patch in-the-wild exploitation of CVE-2025-3648 has been confirmed, but with ~85% of Fortune 500 companies running ServiceNow, self-registration enabled on some public portals, and a free, purpose-built open-source scanner (Snowpick) now published, the exploitation likelihood against unremediated/misconfigured instances has materially increased. Gallegos framed the public release as a defender-empowerment decision: keeping the tool internal would not slow motivated attackers, only the defenders responsible for these systems.

MITRE ATT&CK techniques by tactic:

Discovery

T1069 Permission Groups Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Defense Evasion

T1078 Valid Accounts

Collection

T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

lateral-movement

T1550 Use Alternate Authentication Material

Impact

T1565 Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information; T1595 Active Scanning; T1596 Search Open Technical Databases

Remediation for ServiceNow Count(er) Strike ACL leak

Patches

  • Apply the ServiceNow security update released May 2025 addressing CVE-2025-3648 (Now Platform)
  • Reference ServiceNow KB articles KB2046494, KB2139567, and KB2256712 for patch and configuration guidance

Immediate actions

  • Run Snowpick (or an equivalent authenticated review) against every public-facing ServiceNow Service Portal instance you own to identify exposed widgets and tables
  • Review all public Service Portal widgets for unauthenticated access, especially those returning ticket, attachment, knowledge base, catalog, or list data
  • Review Table REST API access separately from widget access, since the two surfaces do not enforce ACLs identically
  • Audit ACL configurations for tables carrying sensitive data where Required Roles and Security Attribute Condition fields are empty and only Data/Script Conditions are set
  • Disable ServiceNow self-registration on public portals unless explicitly required for business operations
  • Restrict or disable dot-walking on sensitive reference fields to prevent cross-table pivoting

Workarounds

  • Where patching/upgrading is delayed, manually add Security Data Filters to suppress count/rows-removed messages on sensitive tables
  • Temporarily restrict anonymous/public access to Service Portal widgets identified as exposed by Snowpick or manual testing
  • Disable or restrict the ticket-attachments widget on public portals, the dominant exposure vector observed in Bishop Fox's dataset

Longer-term hardening

  • Apply ServiceNow's Query ACLs (query_range and query_match operations) to all tables containing PII, credentials, PHI, or proprietary data
  • Implement Security Data Filters on critical tables to suppress the record-count/'rows removed by security constraints' information leak
  • Migrate sensitive-table ACLs to the Deny-Unless ACL type so all deny conditions must be satisfied in addition to allow conditions
  • Establish periodic (e.g. quarterly) external unauthenticated testing of public ServiceNow portals as part of continuous SaaS security posture management
  • Monitor for automated enumeration patterns (repeated sysparm_query requests with incrementally modified filters/range operators) against list pages and the Table REST API

Affected and fixed versions

  • ServiceNow — Now Platform
    Vulnerable versions: Instances with pre-May 2025 security update and misconfigured ACLs (empty Required Roles / Security Attribute Condition, restrictions only at Data/Script Condition level)
    Fixed in: Instances with May 2025 ServiceNow security update applied and Query ACLs / Security Data Filters / Deny-Unless ACLs configured on sensitive tables

Timeline of ServiceNow Count(er) Strike ACL leak

  • Security researcher Aaron Costello publishes original research on the locked-ioc-7 unauthenticated-exposure technique in ServiceNow, foundational to later locked-ioc-16 methodology.
  • Varonis Threat Labs discovers the ACL data-inference weakness (later named 'Count(er) Strike') and privately discloses it to ServiceNow.
  • ServiceNow releases a security update introducing Query ACLs, Security Data Filters, and Deny-Unless ACLs to remediate the data-inference weakness.
  • CVE-2025-3648 formally assigned to the ServiceNow ACL data-inference vulnerability.
  • Varonis Threat Labs and multiple outlets (The Hacker News, SC Media, others) publicly detail CVE-2025-3648 'Count(er) Strike' and ServiceNow's mitigation framework.
  • Help Net Security publishes coverage of the locked-ioc-16 release and exposure statistics, referencing CVE-2025-3648 as related prior research.
  • Bishop Fox discloses that authorized testing across 166 ServiceNow instances found 31% (52 instances) exposing sensitive data without authentication, affecting roughly 75% of tested organizations.
  • Bishop Fox publicly releases locked-ioc-16, an open-source Go scanner for unauthenticated ServiceNow data exposure across Service Portal widgets and the Table REST API.

Sources cited for ServiceNow Count(er) Strike ACL leak

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats