Snowpick: Open-Source Scanner Exposes Widespread Unauthenticated Data Leakage in ServiceNow Instances (CVE-2025-3648 "Count(er) Strike" Context) — Threadlinqs Intelligence
As of 2026-07-22, Snowpick: Open-Source Scanner Exposes Widespread Unauthenticated Data Leakage in ServiceNow Instances (CVE-2025-3648 "Count(er) Strike" Context) is a medium-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1604 · Severity: MEDIUM · CVSS: 8.2 · Status: ACTIVE · Category: VULNERABILITY
Bishop Fox released Snowpick, an open-source Go tool that probes ServiceNow Service Portal widgets and the Table REST API for unauthenticated data exposure; testing 166 real-world instances found 31%
Bishop Fox adversarial operator Emilio Gallegos published Snowpick, a Go-based reconnaissance and exposure-testing tool that simulates an unauthenticated visitor to a public-facing ServiceNow Service Portal. Snowpick requests the public login page to extract a valid ServiceNow session token and cookies, then reuses that unauthenticated session against two distinct API surfaces: the Service Portal Widget API (`/api/now/sp/widget/{widget_id}`), which backs knowledge-base search, catalog browsing, ticket forms, and file/attachment views, and the Table REST API (`/api/now/table/{table_name}`), which queries database tables directly (e.g. sys_user, incident, kb_knowledge, oauth_entity). The tool probes a curated list of default/built-in widgets (ticket-attachments, kb-article-page, kb-search, kb-category-list, sc-category, simple-list, widget-simple-list) plus 26 built-in table/field combinations spanning users, incidents, departments, companies, assets, attachments, catalog items, customer records, and operational tasks, and can additionally query the target instance for which widgets are installed to extend probing to custom, org-specific widgets. Findings are classified as exposed (records/evidence fields returned), count_oracle (ServiceNow confirms matching records exist without returning rows), or not_exposed, with structured JSON output and reproduction-ready curl commands plus heuristic impact hints (PII, credentials, infrastructure, internal operations).
Across 166 ServiceNow instances tested with authorization, 31% (52 instances) returned at least one exposed or count_oracle finding, and roughly three-quarters of the organizations represented in the dataset had at least one affected instance. The ticket-attachments widget was the dominant exposure vector; two instances leaked no data via widgets but were exposed through the raw Table REST API instead. Exposed data included attachment titles/descriptions revealing internal business processes, knowledge base articles, incident ticket metadata, service catalog items, department structures, and facility locations, with record counts per finding ranging from dozens to thousands. No credentials were observed in this specific dataset, though Snowpick's classification scheme explicitly tracks credential exposure as a possible impact category.
Snowpick's release builds on and operationalizes the underlying access-control weakness class documented by Varonis Threat Labs as CVE-2025-3648, nicknamed "Count(er) Strike" (CWE-1220, CVSS v4.0 8.2 HIGH: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). ServiceNow's ACL engine evaluates access in a four-stage hierarchy — required roles, security attribute conditions, data conditions, and script conditions — where an empty condition at any stage is treated as unrestricted. When only the data/script condition stages carry restrictions, a failed check does not fully block the request: ServiceNow's list-page UI still surfaces the total record count plus a "Number of rows removed from this list by Security constraints" message. Attackers abuse this residual signal by appending crafted sysparm_query filters (STARTSWITH, CONTAINS, EQUALS, range comparisons, boolean AND/OR combinators) to binary-search field values one character or condition at a time — a classic blind/count-based inference (side-channel) attack — and can pivot across tables via dot-walking on reference fields to reach data not directly exposed by the vulnerable table's own ACLs. Varonis discovered and privately disclosed the flaw to ServiceNow in February 2024; ServiceNow shipped a security update in May 2025 and the CVE was formally assigned on July 8, 2025. ServiceNow's remediation introduced three new access-control primitives: Query ACLs (with query_range operations restricting dangerous operators like STARTSWITH/CONTAINS/range comparisons, and query_match operations permitting only safe exact-match operators such as EQUALS/IN/ISNULL), Security Data Filters (post-ACL
Target sectors: government administration, finance, health, technology, manufacturing, retail, energy, telecoms, education, professionalservices
Target regions: North America, Europe, Global
Detections & IOCs
As of 2026-07-22, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, MEDIUM, threat intelligence, cybersecurity, CVE-2025-3648, T1591, T1589, T1596, T1595, T1587, T1588, T1190, T1078, T1526, T1580