[HN Gopher] ServiceNow Insecure Access Control to Full Admin Tak...
___________________________________________________________________
ServiceNow Insecure Access Control to Full Admin Takeover
Author : muscaw
Score : 52 points
Date : 2023-07-07 21:25 UTC (1 hours ago)
(HTM) web link (x64.sh)
(TXT) w3m dump (x64.sh)
| frakt0x90 wrote:
| Almost exactly a year from report to disclosure. I'm sure it
| varies a lot, but is that a normal timeline for something this
| severe?
| stigz wrote:
| No, judging from the Disclosure Timeline at the very bottom, it
| appears the lengthy remediation is due to ServiceNow dragging
| their feet. Took them over a month, plus a followup email, just
| to get them to respond to the initial report.
| 6D794163636F756 wrote:
| It can really depend on the nature of the vulnerability and who
| discovered it. Based on the timeline at the bottom of this
| article it seems like this was way too slow. Based on the cve
| information this was ranked as 9.8. The last time I dealt with
| a bug that bad it was log4j. It was found on a Tuesday, patched
| on a Thursday, announced on a Friday, and I redeployed all of
| our servers over the weekend.
|
| The most egregious part in my eyes is the slow response to the
| initial contact. In shows that Service Now does not monitor
| it's reporting and that they don't care about security. If I
| were using a product of theirs to handle proprietary or
| privileged information I would no longer trust them.
| chevman wrote:
| Of all the shitty enterprise software vendors, there is no
| platform I hate more than ServiceNow.
|
| What an abomination of something seemingly so simple made into
| something so horrendously complex and bloated.
|
| I was trying to explain to some new ServiceNow AE why we wouldn't
| be buying more product from them. Literally everyone who uses the
| product hates it - developers, admins, end users.
|
| It behaves like it is constantly broken.
|
| People talk shit about it all day, every day.
|
| Maybe one day, some time a long time ago they had a good product,
| and that's how it got embedded all over the place, but now, what
| a pile of junk!
| clivestaples wrote:
| I worked there for exactly two months. After 15 days, I could
| not receive another offer and put in my notice fast enough.
| Ended up giving them four days. And I'm usually very careful
| about not burning bridges.
| NikolaNovak wrote:
| What makes it so bad?
|
| We are likely to get it next year . I feel it cannot be worse
| than the aberration we are currently using but I could be wrong
| :-/
| vxNsr wrote:
| It's secret super power for executives is GQL it's easier to
| use vs SQL and the interface looks slick compared to what's
| out there.
|
| A very well architected instance looks and is pretty good,
| the issue is that often large enterprises will hire the
| cheapest possible consulting firm to implement it, and you
| can really screw it up if you're not careful.
| NikolaNovak wrote:
| My background is ERP so that sounds similar then - the
| bones may be decent, but how you implement it can make or
| break it, both as IT exercise and as business
| transformation / process implementation; is that About
| right?
|
| I will likely have _some_ input on how it 's implemented
| and particularly the processes. I guess I should start
| reading up on best practices etc...
| version_five wrote:
| I think all that generally applies to enterprise software like
| that, no? SAP is absolute garbage but it ticks various C-level
| agenda items (mainly the act itself of investing in ERP
| modernization) and so it sells regardless. Servicenow I belive
| makes it harder for employees to get help and thus saves labor.
| Enterprise software isn't for you or me, that's why we hate it.
| robertlagrant wrote:
| When it started it was the great hope vs the incumbents. I
| never used it, but it used to be very well thought of.
| wintogreen74 wrote:
| >> Of all the shitty enterprise software vendors, there is no
| platform I hate more than ServiceNow.
|
| Forget about their enterprise software, the very premise of the
| function they support is the thing I hate most. The software,
| the company, the consultants who push this garbage, the
| employees within your company who somehow have a named role
| implementing and managing it, I loathe it all.
___________________________________________________________________
(page generated 2023-07-07 23:00 UTC)