glide.xml.entity.whitelist and glide.stax.whitelist_enabled: XML external entity hardening in ServiceNow

What the XML entity properties do

An XML document can start with a <!DOCTYPE> declaration that points to an external file, the DTD, or defines entities that load content from a URL. A parser that follows those references can be tricked into calling internal systems or reading data. This is called an XML external entity (XXE) attack.

glide.xml.entity.whitelist.enabled switches on an allowlist check for these external references. glide.xml.entity.whitelist holds the allowed sources as a comma-separated list. ServiceNow recommends the value http://java.sun.com/j2ee/dtds/, the standard Java EE DTD location. Anything else is not needed for the out of the box platform, and every extra value should be reviewed.

The streaming parser behind XMLDocument2 has its own pair. glide.stax.allow_entity_resolution is false by default, so this parser does not resolve entities at all. Only if a customization needs entity resolution and you set it to true does glide.stax.whitelist_enabled (default true) limit it to the hosts in glide.xml.entity.whitelist.

These properties do not decide which XML files you may import, and they do not block normal XML. Record exports, update sets, import set XML and SOAP messages contain no external DTD reference and keep working.

1. Run the check script at the end of this page to see the current values.
2. If glide.xml.entity.whitelist.enabled is already true, nothing is left to do except keep the allowlist short.
3. Leave glide.stax.allow_entity_resolution on false unless a documented customization needs it.
4. Keep glide.xmlutil.max_entity_expansion at 3000 or lower, the recommended limit against entity expansion denial of service.

Check whether anything uses external DTDs

Only XML that contains a <!DOCTYPE ... SYSTEM "http..."> or <!ENTITY ... SYSTEM ...> reference to a source outside the allowlist is affected. Look in the XML itself, not in the property: open a sample message or file and search the first lines for DOCTYPE and ENTITY. If neither appears, the allowlist does not touch that integration.

Typical places where third-party XML enters an instance are scripted SOAP and REST services, script includes and business rules that parse XML received from an outbound call, scheduled jobs that fetch XML feeds, and import data sources with format XML. SOAP messages are not allowed to carry a DOCTYPE by the SOAP standard, so plain SOAP integrations are rarely affected.

1. List integrations that send or receive XML, from your integration inventory or from REST messages, SOAP messages and data sources on the instance.
2. Run the search script below on a sub-production instance. It lists scripts that parse XML or mention a DOCTYPE, so you know where to look.
3. For each hit and each XML integration, take one real payload and search it for DOCTYPE and ENTITY. Note the URL after SYSTEM if there is one.
4. Add only trusted hosts that you really found to glide.xml.entity.whitelist, comma separated, next to http://java.sun.com/j2ee/dtds/.
5. Enable glide.xml.entity.whitelist.enabled on sub-production, run each XML integration and import once, and check the system log for XML parsing errors.

Read-only background script that lists scripts which parse XML or mention a DOCTYPE. Run it in System Definition > Scripts - Background on a sub-production instance.

// Read only: lists scripts that parse XML or reference a DOCTYPE.
var tables = {
  'sys_script_include': 'script',
  'sys_script': 'script',
  'sysauto_script': 'script',
  'sys_ws_operation': 'operation_script',
  'sys_web_service': 'script',
  'sys_processor': 'script'
};
var terms = ['XMLDocument2', 'XMLDocument(', 'GlideXMLUtil', 'DOCTYPE', 'ENTITY'];
for (var t in tables) {
  for (var i = 0; i < terms.length; i++) {
    var gr = new GlideRecord(t);
    if (!gr.isValid()) continue;
    gr.addQuery(tables[t], 'CONTAINS', terms[i]);
    gr.query();
    while (gr.next()) {
      gs.print(t + ' | ' + gr.getDisplayValue() + ' | ' + terms[i] + ' | ' + gr.getUniqueValue());
    }
  }
}

Enable it and tell your integration owners

Because the change cannot be reverted, roll it out like a release: sub-production first, a short note to integration owners, then production in a planned window.

The note below is a starting point for that email. Replace the parts in brackets.

1. Set glide.xml.entity.whitelist to http://java.sun.com/j2ee/dtds/ plus any trusted hosts from the impact check. Create the record if it does not exist.
2. Set glide.xml.entity.whitelist.enabled to true on sub-production and run every XML integration and import once.
3. Send the impact note to the owners of XML integrations and give them time to test.
4. Enable it in production. If an integration later fails with a parsing error, check its payload for a new external DTD source and add that host to the allowlist after a review.

Impact note you can adapt for your team:

Subject: ServiceNow security hardening - XML external entity allowlist

Hi all,

As part of ServiceNow security hardening we will enable the system property
glide.xml.entity.whitelist.enabled on [instance] on [date].

What changes: XML that references an external DTD or entity (a <!DOCTYPE ... SYSTEM "http...">
or <!ENTITY ... SYSTEM ...> line) is only processed if the source is on our allowlist
(glide.xml.entity.whitelist). Today the allowlist contains http://java.sun.com/j2ee/dtds/
[and: other hosts].

What does not change: normal XML without such references, SOAP messages, record
exports, update sets and XML imports keep working.

What we need from you: please check whether XML your integration sends to or receives
from ServiceNow contains a DOCTYPE or ENTITY reference to an external URL, and tell us
the URL by [date]. We tested on [sub-production instance] on [date] with [result].

Note: this setting cannot be switched back once enabled.

Thanks,
[name]

Check your instance

Paste this read-only background script into System Definition > Scripts - Background on a sub-production instance. It prints the current value of every property in this guide. A property without a record runs on its platform default. You can also open sys_properties.list and filter by name.

// Read only: prints the current value of every property in this guide.
// Run in System Definition > Scripts - Background.
var names = [
  'glide.xml.entity.whitelist.enabled',
  'glide.xml.entity.whitelist',
  'glide.stax.allow_entity_resolution',
  'glide.stax.whitelist_enabled',
  'glide.xmlutil.max_entity_expansion',
  'glide.soap.require_content_type_xml',
  'glide.basicauth.required.xml',
  'glide.basicauth.required.xmloutputprocessor',
  'glide.db.impex.XMLLoader.max.file.size.mb',
  'glide.ui.admin_import_xml_roles'
];
var found = {};
var gr = new GlideRecord('sys_properties');
gr.addQuery('name', 'IN', names.join(','));
gr.query();
while (gr.next()) {
  found[gr.getValue('name')] = gr.getValue('value');
}
for (var i = 0; i < names.length; i++) {
  var n = names[i];
  gs.print(n + ' = ' + (found.hasOwnProperty(n) ? found[n] : '(no record on this instance, platform default applies)'));
}

FAQ

Related