Disable Entity Expansion within the XMLDocument2 Streaming Parser [Updated in Security Center 1.5]

  • Release version: Xanadu
  • Updated February 1, 2024
  • 1 minute to read

    • If customizations do not require entity expansion, use the glide.stax.allow_entity_resolution property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities.

    • If you set this property to true, all external entities attempt to resolve or expand subject entities, subject to the setting of the glide.stax.whitelist_enabled property.
    • If you set that property to false, all entity resolution and expansion is blocked. To learn more, see XMLdoc2 entity validation with whitelist.

    Prerequisites

    Before setting this property:
    • Set the glide.xml.entity.whitelist.enabled and glide.stax.whitelist_enabled properties to true. To learn more, see XMLdoc/XMLUtil entity validation with whitelist and XMLdoc2 entity validation with whitelist.
    • Define a listing of comma-delimited FQDN in the glide.xml.entity.whitelist property, which is the only URLs that can be reached using XML Entity processing. property. To learn more, see XML external entity processing - whitelist.
    Warning:
    This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

    More information

    Attribute Description
    Property name glide.stax.allow_entity_resolution
    Configuration type System Properties (/sys_properties_list.do)
    Category Validation, sanitization, and encoding
    Purpose This remediation control must be enabled to defend against an XML Entity Expansion/Billion Laugh attack.
    Recommended value false
    Default value true
    Functional impact If the customization is using entity expansion, then, the ServiceNow AI Platform might block further processing.
    Security risk (Critical) An attacker can use this vulnerability to expand data exponentially, quickly consuming all system resources.
    Workaround If the customization requires entity expansion, set this property to true and follow the steps documented in XMLdoc2 entity validation with whitelist.

    To learn more about adding or creating a system property, see Add a system property

    For more information about OWASp resources, see OWASp.