Require XMLdoc2 entity validation with allowlistDisable entity expansion [Updated in Security Center 1.3]
Summarize
Summary of Require XMLdoc2 entity validation with allowlistDisable entity expansion [Updated in Security Center 1.3]
This documentation addresses how ServiceNow customers can secure their platform against XML External Entity (XXE) attacks by managing entity expansion during XML parsing in the XMLDocument2 (XMLdoc2) streaming parser. The guidance focuses on system properties that control entity resolution and expansion, enabling customers to prevent resource exhaustion caused by malicious XML inputs.
Show less
Key Features
- Entity Expansion Control: Use the
glide.xmlutil.maxentityexpansionproperty to completely disable external entity expansion when customizations do not require it. This allows XML parsing to complete without processing any internal or external entities. - Entity Resolution Settings: The
glide.stax.allowentityresolutionproperty controls whether external entities are resolved or expanded. Setting it tofalseblocks all entity resolution and expansion, whiletrueallows resolution subject to whitelist restrictions. - Whitelist Enforcement: The
glide.stax.whitelistenabledproperty must be set totrueto enable an allowlist of safe domains defined in theglide.xml.entity.whitelistproperty. Only URLs in this whitelist can be accessed during XML entity processing. - Safe Harbor Property: The
glide.stax.whitelistenabledproperty is a safe harbor property—once enabled, its value cannot be changed or reverted, ensuring consistent security enforcement.
Key Outcomes
- Enhanced Security: Enabling these properties mitigates the risk of XXE attacks, which can exponentially expand data and exhaust system resources, rated with a high security risk of 9.8.
- Controlled XML Parsing: Customers can safely allow entity expansion only when necessary and restrict it to trusted domains, preventing unauthorized or malicious external entity access.
- Customization Impact: Customers using entity expansion in customizations should carefully enable the whitelist and define allowed URLs; otherwise, entity expansion is blocked to maintain security.
- Non-revertible Configuration: Since the whitelist enablement is non-revertible, customers must plan and test before applying these changes in production environments.
Practical Guidance
- Before enabling entity resolution, set
glide.stax.whitelistenabledandglide.xml.entity.whitelist.enabledtotrue. - Define a comma-separated list of fully qualified domain names (FQDNs) in
glide.xml.entity.whitelistto restrict external entity processing to trusted URLs. - If entity expansion is not required, disable it entirely using
glide.xmlutil.maxentityexpansionor setglide.stax.allowentityresolutiontofalse. - Follow documented procedures for adding or modifying system properties to implement these settings safely.
If customizations do not require entity expansion, use the glide.xmlutil.max_entity_expansion property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities.
If the glide property glide.stax.whitelist_enabled doesn't exist in the System Properties [sys_properties] table, or is not set to the recommended value of true, then all external entities are allowed when the glide property glide.stax.allow_entity_resolution is set to the value of true.
If customizations don't require entity expansion, use the glide.stax.allow_entity_resolution property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities.
- If you set glide.stax.allow_entity_resolution to true, all external entities attempt to resolve or expand subject entities, subject to the setting of the glide.stax.whitelist_enabled property.
- If you set glide.stax.allow_entity_resolution to false, all entity resolution and expansion is blocked. To learn more about this property, see Disable Entity Expansion within the XMLDocument2 Streaming Parser [Updated in Security Center 1.5].
When glide.stax.whitelist_enabled is set to true, define a listing of comma-delimited FQDN in the glide.xml.entity.whitelist property, which are the only URLs that can be reached using the XML entity processing property. To learn more, see Restrict XML external entities [Updated in Security Center 1.3 and 2.0]. Attackers can use this vulnerability to expand data exponentially in an External Entities Expansion (XXE) attack, quickly consuming all system resources.
Prerequisites
- Set the glide.xml.entity.whitelist.enabled and glide.stax.whitelist_enabled properties to true. To learn more, see Restrict XML external entities [Updated in Security Center 1.3 and 2.0].
- Define a listing of comma-delimited FQDN in the glide.xml.entity.whitelist property, which is the only URLs that can be reached using XML Entity processing property. To learn more, see Restrict XML external entities [Updated in Security Center 1.3 and 2.0].
More information
| Attribute | Description |
|---|---|
| Property name | glide.stax.whitelist_enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | Validation, sanitization, and encoding |
| Purpose | This remediation control must be enabled to defend against an XML Entity Expansion/Billion Laugh attack. |
| Recommended value | true |
| Default value | false |
| Security risk rating | 9.8 |
| Functional impact | If the customization is using entity expansion, then, the ServiceNow AI Platform might block further processing. |
| Security risk | An attacker can use this vulnerability to expand data exponentially in an External Entities Expansion (XXE) attack, quickly consuming all system resources. |
| Workaround | If the customization requires entity expansion, set this property to true and follow the steps documented in Restrict XML external entities [Updated in Security Center 1.3 and 2.0]. |
To learn more about adding or creating a system property, see Add a system property.
For more information about OWASp resources, see OWASp.