ServiceNow third-party & OAuth apps security checks
OAuth grants, marketplace apps, integrations, plugins and automations with standing access to company data — the SaaS-to-SaaS supply chain.
On ServiceNow, Black Cat runs 4 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the ServiceNow connector needs.
Checks (4)
severity: medium OAuth App Long Token Lifespan fix difficulty: easy #
Reduce the OAuth access token lifespan to 3600 seconds (1 hour) or less
- Navigate to System OAuth > Application Registry
- Open the flagged OAuth application record
- Locate the "Access Token Lifespan" field
- Change the value to 3600 or less
- Save the record
- Notify consuming applications that tokens will expire sooner and must be refreshed
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: high OAuth App Insecure Redirect fix difficulty: easy #
Update OAuth application redirect URLs to use HTTPS and avoid wildcard patterns
- Navigate to System OAuth > Application Registry
- Open the flagged OAuth application record
- Locate the "Redirect URL" field
- Change the redirect URL to use HTTPS instead of HTTP
- Remove any wildcard characters from the redirect URL
- Use the most specific URL path possible
- Save the record and test the OAuth flow
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: medium Insecure Plugin Active fix difficulty: medium #
Deactivate plugins with known security risks that are not required for business operations
- Navigate to System Definition > Plugins
- Search for the flagged plugin by ID or name
- Confirm with the application owner whether the plugin is actively used
- If not required, click "Deactivate" to disable the plugin
- Test that core functionality is unaffected after deactivation
- Document the deactivation decision
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: high Integration Using Basic Auth fix difficulty: hard #
Migrate integrations from basic authentication to OAuth or certificate-based authentication
- Navigate to System Web Services > REST Message or the relevant integration registry
- Open the flagged integration record
- Change the authentication type from "Basic" to "OAuth 2.0" or "Mutual Authentication"
- Configure the appropriate OAuth client credentials or certificates
- Test the integration to confirm it connects successfully with the new authentication method
- Remove any stored basic auth credentials from the record
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12