# Snowpick: Open-Source Scanner Exposes Widespread Unauthenticated Data Leakage in ServiceNow Instances (CVE-2025-3648 "Count(er) Strike" Context)

> Bishop Fox released Snowpick, an open-source Go tool that probes ServiceNow Service Portal widgets and the Table REST API for unauthenticated data exposure; testing 166 real-world instances found 31% (52 instances) leaked sensitive records, affecting roughly 75% of the organizations tested. The release follows and operationalizes prior Varonis Threat Labs research into CVE-2025-3648 ("Count(er) Strike"), a data-inference flaw in ServiceNow's Access Control List (ACL) evaluation that lets authenticated and unauthenticated users infer restricted record data via crafted range/count queries.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1604
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-servicenow-count-er-strike-acl-leak-tl-2026-1604.webp?v=7aacf4aa (Threadlinqs threat intel: CVE-2025-3648 Snowpick ServiceNow Leaks: Detection & IOCs (TL-2026-1604) — Medium severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-1604
- **Severity:** MEDIUM (CVSS 8.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 18
- **CVEs:** CVE-2025-3648

## Description

Bishop Fox adversarial operator Emilio Gallegos published Snowpick, a Go-based reconnaissance and exposure-testing tool that simulates an unauthenticated visitor to a public-facing ServiceNow Service Portal. Snowpick requests the public login page to extract a valid ServiceNow session token and cookies, then reuses that unauthenticated session against two distinct API surfaces: the Service Portal Widget API (`/api/now/sp/widget/{widget_id}`), which backs knowledge-base search, catalog browsing, ticket forms, and file/attachment views, and the Table REST API (`/api/now/table/{table_name}`), which queries database tables directly (e.g. sys_user, incident, kb_knowledge, oauth_entity). The tool probes a curated list of default/built-in widgets (ticket-attachments, kb-article-page, kb-search, kb-category-list, sc-category, simple-list, widget-simple-list) plus 26 built-in table/field combinations spanning users, incidents, departments, companies, assets, attachments, catalog items, customer records, and operational tasks, and can additionally query the target instance for which widgets are installed to extend probing to custom, org-specific widgets. Findings are classified as exposed (records/evidence fields returned), count_oracle (ServiceNow confirms matching records exist without returning rows), or not_exposed, with structured JSON output and reproduction-ready curl commands plus heuristic impact hints (PII, credentials, infrastructure, internal operations).

Across 166 ServiceNow instances tested with authorization, 31% (52 instances) returned at least one exposed or count_oracle finding, and roughly three-quarters of the organizations represented in the dataset had at least one affected instance. The ticket-attachments widget was the dominant exposure vector; two instances leaked no data via widgets but were exposed through the raw Table REST API instead. Exposed data included attachment titles/descriptions revealing internal business processes, knowledge base articles, incident ticket metadata, service catalog items, department structures, and facility locations, with record counts per finding ranging from dozens to thousands. No credentials were observed in this specific dataset, though Snowpick's classification scheme explicitly tracks credential exposure as a possible impact category.

Snowpick's release builds on and operationalizes the underlying access-control weakness class documented by Varonis Threat Labs as CVE-2025-3648, nicknamed "Count(er) Strike" (CWE-1220, CVSS v4.0 8.2 HIGH: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). ServiceNow's ACL engine evaluates access in a four-stage hierarchy — required roles, security attribute conditions, data conditions, and script conditions — where an empty condition at any stage is treated as unrestricted. When only the data/script condition stages carry restrictions, a failed check does not fully block the request: ServiceNow's list-page UI still surfaces the total record count plus a "Number of rows removed from this list by Security constraints" message. Attackers abuse this residual signal by appending crafted sysparm_query filters (STARTSWITH, CONTAINS, EQUALS, range comparisons, boolean AND/OR combinators) to binary-search field values one character or condition at a time — a classic blind/count-based inference (side-channel) attack — and can pivot across tables via dot-walking on reference fields to reach data not directly exposed by the vulnerable table's own ACLs. Varonis discovered and privately disclosed the flaw to ServiceNow in February 2024; ServiceNow shipped a security update in May 2025 and the CVE was formally assigned on July 8, 2025. ServiceNow's remediation introduced three new access-control primitives: Query ACLs (with query_range operations restricting dangerous operators like STARTSWITH/CONTAINS/range comparisons, and query_match operations permitting only safe exact-match operators such as EQUALS/IN/ISNULL), Security Data Filters (post-ACL filtering that also suppresses the "rows removed" leak message), and a new Deny-Unless ACL type requiring ALL deny-unless conditions to be satisfied in addition to existing allow-if conditions, closing the single-ACL-pass-grants-access loophole. No pre-patch in-the-wild exploitation of CVE-2025-3648 has been confirmed, but with ~85% of Fortune 500 companies running ServiceNow, self-registration enabled on some public portals, and a free, purpose-built open-source scanner (Snowpick) now published, the exploitation likelihood against unremediated/misconfigured instances has materially increased. Gallegos framed the public release as a defender-empowerment decision: keeping the tool internal would not slow motivated attackers, only the defenders responsible for these systems.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1589 Gather Victim Identity Information
- T1596 Search Open Technical Databases
- T1595 Active Scanning
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1083 File and Directory Discovery
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1550 Use Alternate Authentication Material
- T1078 Valid Accounts
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unauthenticated ServiceNow Service Portal Widget Enumeration (Snowpick-style)** (`TL-2026-1604-SPL-001`)

Detects a single unauthenticated client hammering the Service Portal Widget API (/api/now/sp/widget/{widget_id}) across multiple distinct widget IDs in a short window — the signature reconnaissance pattern of Snowpick and its predecessor 'widget-simple-list' technique used to probe for CVE-2025-3648 (Count(er) Strike) style ACL exposures.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1595, T1190, T1213
- **Data sources:** servicenow_web_access_log, waf_http_logs, reverse_proxy_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=servicenow:webserver cs_uri_stem="/api/now/sp/widget/*" c_authenticated=false
| eval widget_id=mvindex(split(cs_uri_stem,"/"),-1)
| bin _time span=5m
| stats dc(widget_id) as distinct_widgets, values(widget_id) as widgets, count as request_count by c_ip, _time
| where distinct_widgets >= 4 OR request_count >= 8
| sort -distinct_widgets
```

### Microsoft KQL

```kql
let lookback = 24h;
ServiceNowWebLog
| where TimeGenerated > ago(lookback)
| where cs_uri_stem has "/api/now/sp/widget/"
| where c_authenticated == false
| extend WidgetId = tostring(split(cs_uri_stem, "/")[-1])
| summarize DistinctWidgets = dcount(WidgetId), Widgets = make_set(WidgetId), RequestCount = count() by c_ip, bin(TimeGenerated, 5m)
| where DistinctWidgets >= 4 or RequestCount >= 8
| project TimeGenerated, c_ip, DistinctWidgets, RequestCount, Widgets
| sort by DistinctWidgets desc
```

### Sigma

```yaml
title: Unauthenticated ServiceNow Service Portal Widget Enumeration (Snowpick-style)
id: 8f3c1b2e-1a4d-4e2a-9b3f-a1c2d3e4f501
status: experimental
description: Detects a single unauthenticated source enumerating multiple built-in Service Portal widgets, consistent with Snowpick's widget-exposure probing (CVE-2025-3648 context).
references:
    - https://github.com/BishopFox/snowpick
    - https://www.varonis.com/blog/counter-strike-servicenow
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.reconnaissance
    - attack.t1595
    - attack.t1590
    - cve.2025.3648
    - attack.tool.snowpick
logsource:
    category: webserver
    product: servicenow
detection:
    selection:
        cs-uri-stem|contains: '/api/now/sp/widget/'
        c-authenticated: false
    timeframe: 5m
    condition: selection | count(cs-uri-stem) by c-ip > 5
falsepositives:
    - Legitimate anonymous portal browsing at low volume
    - Load-testing or synthetic monitoring against the public portal
level: high
```

**Known false positives:**

- Legitimate anonymous visitors browsing multiple public knowledge-base or catalog widgets in normal succession
- Uptime/synthetic monitoring tools polling multiple public widgets

**Tuning notes:** Baseline normal anonymous-portal widget-view volume per organization before enabling alerting; raise distinct_widgets/request_count thresholds for high-traffic public portals and exclude known monitoring-service source IPs/user agents.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ServiceNow Table REST API Range-Query Inference Pattern (Count(er) Strike) (locked: unlock with TL Creds)
- ServiceNow Dot-Walking Cross-Table Pivot via Reference-Field Query (locked: unlock with TL Creds)
- Anonymous ServiceNow Session-Cookie Harvest Immediately Followed by Sensitive Table Access (locked: unlock with TL Creds)
- Sigma: Automated Snowpick-style Scanner User-Agent/Timing Signature on ServiceNow (locked: unlock with TL Creds)
- Sigma: ServiceNow Record-Count Security-Constraint Leak Response at Abnormal Frequency (locked: unlock with TL Creds)
- Sigma: High-Volume Unauthenticated Exfiltration via Table REST API (Automated Collection) (locked: unlock with TL Creds)
- ServiceNow [indicator] Widget Repeated Unauthenticated Access (locked: unlock with TL Creds)
- Custom Widget Discovery via ServiceNow Portal Widget-List Enumeration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [ServiceNow instances leaking sensitive data via unauthenticated access, Snowpick scanner shows](https://www.helpnetsecurity.com/2026/07/22/servicenow-data-exposure-snowpick-open-source-scanner/)
- [Snowpick (GitHub repository)](https://github.com/BishopFox/snowpick)
- [Introducing snowpick: Testing ServiceNow for Public Data Exposure](https://bishopfox.com/blog/introducing-snowpick-testing-servicenow-for-public-data-exposure)
- [Count(er) Strike – Data Inference Vulnerability in ServiceNow](https://www.varonis.com/blog/counter-strike-servicenow)
- [ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs](https://thehackernews.com/2025/07/servicenow-flaw-cve-2025-3648-could.html)
- [ServiceNow issues CVE for high-severity ACL bug](https://www.scworld.com/news/servicenow-patches-high-severity-acl-bug)
- [CVE-2025-3648: "Count(er) Strike" Vulnerability in ServiceNow](https://op-c.net/blog/servicenow-cve-2025-3648-counter-strike-vulnerability/)
- [SaaS Security Alert: High-severity data exposure vulnerability identified in ServiceNow platform (Count(er) Strike)](https://www.nudgesecurity.com/post/high-severity-data-exposure-vulnerability-identified-in-servicenow-platform-count-er-strike)
- [ServiceNow Flaw CVE-2025-3648 can lead to data exposure via misunderstood ACLs](https://capalearning.com/2025/07/10/servicenow-flaw-cve-2025-3648-could-lead-to-data-exposure-via-misconfigured-acls/)
- [ServiceNow KB2046494 (patch/config guidance)](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2046494)
- [ServiceNow KB2139567 (Query ACLs / Security Data Filters)](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2139567)
- [ServiceNow KB2256712 (Deny-Unless ACL guidance)](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2256712)
- [ServiceNow: Securing public-facing widgets (KB1553688)](https://support.servicenow.com/kb?id=kb%5Farticle%5Fview&sysparm%5Farticle=KB1553688)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1604