danielmadsendk/servicenow-cve-2025-11449-cve-2025-11450-mitigation-scriptAutomated detection and remediation of ServiceNow UI Macro vulnerabilities (CVE-2025-11449, CVE-2025-11450) by encoding sysparm_ parameters to prevent XSS attacks.
This script automatically detects and remediates CVE-2025-11449 and CVE-2025-11450 security vulnerabilities in ServiceNow UI Macros. These vulnerabilities could allow arbitrary code execution in users' browsers through specially crafted links if user-controlled sysparm_ parameters are not properly sanitized.
$pwd_verify_email$pwd_verify_personal_data_uiThe script performs two key security fixes:
<g:evaluate> BlocksReplaces vulnerable patterns with properly encoded versions:
${sysparm_<XYZ>} → ${JS,HTML:sysparm_<XYZ>}${HTML:sysparm_<XYZ>} → ${JS,HTML:sysparm_<XYZ>}${JS:sysparm_<XYZ>} → ${JS,HTML:sysparm_<XYZ>}<g:evaluate> Blocks: Uses Jelly variable referencesReplaces string interpolation with safe Jelly object references:
"${sysparm_<XYZ>}" → jelly.sysparm_<XYZ> (removes quotes!)${HTML:sysparm_<XYZ>} → jelly.sysparm_<XYZ>${JS,HTML:sysparm_<XYZ>} → jelly.sysparm_<XYZ> (still unsafe inside <g:evaluate>)Backup First!
// Export your current UI Macros before running this script
// Navigate to: System UI > UI Macros
// Export: $pwd_verify_email and $pwd_verify_personal_data_ui
Run the Detection Script
CVE_2025_11449_fix.jsReview the Output
Apply the Fix
Test Thoroughly
AFFECTED Macro: $pwd_verify_personal_data_ui (sys_id: abc123...) [ACTIVE - HIGH PRIORITY]
Found 8 vulnerable sysparm_ pattern(s) outside <g:evaluate>:
- ${HTML:sysparm_verification_id}
- ${HTML:sysparm_verification_id}
- ${HTML:sysparm_verification_id}
- ${HTML:sysparm_verification_id}
- ${HTML:sysparm_verification_id}
... and 3 more
Found 1 vulnerable sysparm_ pattern(s) inside <g:evaluate>:
- "${sysparm_verification_id}"
Suggested Cured XML:
[Fixed XML output here]
---
To check additional UI Macros, modify line 3:
var macrosToCheck = ['$pwd_verify_email', '$pwd_verify_personal_data_ui', 'your_custom_macro'];
CRITICAL: These vulnerabilities allow Cross-Site Scripting (XSS) attacks that could:
Found an issue or have an improvement? Please:
MIT License - Feel free to use, modify, and distribute.
Use at your own risk! Always:
This script is provided as-is without warranty. The author is not responsible for any damage or issues caused by its use.
The script was generated by ServiceNow Helper by Daniel Aagren Seehartrai Madsen
Created to help the ServiceNow community address critical security vulnerabilities quickly and safely.