The latest and greatest vulnerability to hit corporations is the Log4j vulnerability that allows remote code execution on platforms using the java library.

How does this impact ServiceNow?

ServiceNow uses Log4j like many other java based applications for its great logging ability. It's used on the core platform as the backend; for MID servers; and for edge encryption proxies.

Do I need to be concerned?

ServiceNow's posture on the 0-day exploit is that instances of the Now Platform are running a version of Java that, by default, implements settings to prevent this vulnerability. More clearly, the below settings are used by default by the JDK versions in use that mitigate against this potential vulnerability

• com.sun.jndi.ldap.object.trustURLCodebase=false
• com.sun.jndi.rmi.object.trustURLCodebase=false

ServiceNow MID Servers, which you deploy behind your firewalls, are lightweight Java Virtual Machines (JVM). MID server code does not use log4j directly and disabled third-party library usage of log4j. Moreover, the OpenJDK versions that ship with the MID installation file(s) are not vulnerable.

• Paris: OpenJDK 1.8.0_231
• Quebec: OpenJDK 11.0.8
• Rome: OpenJDK 11.0.9.1

These versions have the same trust settings as above and no further changes need to be made.

How can I tell what Java version I have?

You can do this quite simply via your operating systems command-line tool using "java -version". The screenshot below is a Windows environment

t

I'm using an older JDK / a JDK not shipped by ServiceNow

If you're on an older release of ServiceNow or using a different vendors Java edition, you can add a property to the MID wrapper configuration file:

• Navigate to your MID server directory
• Navigate to /agent/conf/wrapper.override.conf
• Add the following to parameters section towards the bottom of the file:
• * wrapper.java.additional.209=-Dlog4j2.formatMsgNoLookups=true
  
  • wrapper.java.additional.210=-Dcom.sun.jndi.ldap.object.trustURLCodebase=false
    
  • wrapper.java.additional.211=-Dcom.sun.jndi.rmi.object.trustURLCodebase=false
    
  • wrapper.java.additional.212=-Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false

Where do I go for more information?

ServiceNow customers with Support access can keep up to date via KB1000959

*I'm not affiliated with ServiceNow in any way, I'm just a customer wishing to share wisdom with others. Customers should reference the above Support Article on ServiceNow's official posture and remediation advice*