ServiceNow Misconfigurations Lead to Leak of Sensitive Data

ServiceNow has been alerted to a potential misconfiguration concern that might impact the security of its platform. The company is actively addressing the issue and working towards a resolution.

The issue involves Access Control Lists (ACLs), which are used to control access to tables and columns on the platform. 

If an ACL is empty or does not have any roles, conditions, or scripts, it could allow unauthorized users, including guests, to access some resources.

ServiceNow has found that unauthenticated users have limited access to the platform and can only access some authorized pages. 

However, some public portal widgets, such as SimpleListWidget, can query data from the system. ServiceNow advises customers to follow these steps to check and fix their ACLs:

Check ACL Configurations

Customers should find ACLs that do not have any roles, conditions, or scripts.

If they do not want unauthenticated users to access those tables, they should add `gs.isLoggedIn()` to the script section of the ACLs. This will prevent unauthenticated users from accessing those tables through public portal widgets.

General Security Measures

ServiceNow recommends a thorough review of all ACLs, especially those that are empty or have the role “Public,” to make sure they match the business and security requirements.

Customers should also review their public widgets and disable the “Public” flag if they do not need them.

Customers should use IP Address Access Control to restrict access to their instances to only trusted IP addresses. Alternatively, they can use Adaptive Authentication policies to apply more fine-grained authentication control, allowing mobile access but limiting access to specific IP ranges and subnets.

Explicit Roles Plugin

Instances that use the Explicit Roles plugin are not affected by this issue. ServiceNow advises customers who use this plugin to check their ACLs that have the “public” role and review their User Criteria configurations.

ServiceNow stresses the importance of taking proactive security measures and urges customers to follow these steps to protect their instances.

The guidelines for assessing User Criteria can be located at KB1123580.

ServiceNow will continue to investigate the issue and provide updates and guidance as needed. Stay tuned for more information on this issue.

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.