ServiceNow has been alerted to a potential misconfiguration concern that might impact the security of its platform. The company is actively addressing the issue and working towards a resolution.
The issue involves Access Control Lists (ACLs), which are used to control access to tables and columns on the platform.
If an ACL is empty or does not have any roles, conditions, or scripts, it could allow unauthorized users, including guests, to access some resources.
ServiceNow has found that unauthenticated users have limited access to the platform and can only access some authorized pages.
However, some public portal widgets, such as SimpleListWidget, can query data from the system. ServiceNow advises customers to follow these steps to check and fix their ACLs:
Customers should find ACLs that do not have any roles, conditions, or scripts.
If they do not want unauthenticated users to access those tables, they should add `gs.isLoggedIn()` to the script section of the ACLs. This will prevent unauthenticated users from accessing those tables through public portal widgets.
ServiceNow recommends a thorough review of all ACLs, especially those that are empty or have the role “Public,” to make sure they match the business and security requirements.
Customers should also review their public widgets and disable the “Public” flag if they do not need them.
Customers should use IP Address Access Control to restrict access to their instances to only trusted IP addresses. Alternatively, they can use Adaptive Authentication policies to apply more fine-grained authentication control, allowing mobile access but limiting access to specific IP ranges and subnets.
Instances that use the Explicit Roles plugin are not affected by this issue. ServiceNow advises customers who use this plugin to check their ACLs that have the “public” role and review their User Criteria configurations.
ServiceNow stresses the importance of taking proactive security measures and urges customers to follow these steps to protect their instances.
The guidelines for assessing User Criteria can be located at KB1123580.
ServiceNow will continue to investigate the issue and provide updates and guidance as needed. Stay tuned for more information on this issue.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.
A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…
Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…
ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…
Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…
The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…
Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated cybercriminals to achieve its strategic goals,…