Fabricated Property References

This page describes the nowisor-fabricated-property-references check from the nowisor Instance Scan Pack v1.0.0. The check scans your instance's custom-scope sys_script_include and sys_script records for gs.getProperty() and gs.setProperty() calls, extracts the referenced property names, and validates each against the actual sys_properties table. A finding fires when a script references a property name that does not exist on the instance. A clean install produces no findings.

What this finding means

This check is operational health, not a vulnerability detector. It validates schema integrity between your custom code and the platform's property registry.

When server-side script code calls gs.getProperty('some.property') for a property that doesn't exist, ServiceNow silently returns null (or the default value if one was provided to the call). The script doesn't fail; it just receives empty data. If the script was supposed to make a security decision based on the property value — "if the cache-secure flag is true, do X" — the decision quietly defaults to whatever the empty value implies, often the wrong thing.

The check exists because fabricated property names are a real failure mode in ServiceNow security tooling. Property names are easy to mistype, easy to invent from memory, and easy to copy from outdated documentation. A security check that reads glide.security.use_csrf_tokens instead of glide.security.use_csrf_token (note the trailing s) will always return null — and will always conclude the instance is compliant, regardless of the actual configuration. The verification is silent and the false sense of coverage is permanent.

Findings list the fabricated property name and the script(s) where it was referenced. The expected count on a healthy instance is zero. The finding cap is 20 — if your instance has more than 20 orphaned references, the count is included as an overflow indicator.

Why it matters for your compliance

This is the canonical configuration-integrity finding. It maps to two framework controls indirectly.

NIS2 Article 21§2(a) — risk analysis and information system security policies. Your security policies are encoded in your scripts. A script that references a property that doesn't exist is a documented control whose technical implementation is broken. NIS2 expects the entity to maintain integrity between policy and implementation; this check surfaces the gaps.

ISO 27001 A.8.9 — configuration management. A.8.9 covers configuration integrity at a technical level. A script that depends on a property whose registration was never completed (or was removed during a cleanup) is a configuration management failure — the script and the property registry are out of sync.

Severity 3 (medium) reflects that the check signals operational drift rather than active exploitation. A finding doesn't mean an attacker is currently exploiting anything; it means a control you thought was in place may not actually be enforced.

How to fix it

For each fabricated reference reported:

1. Open the script. The finding's evidence includes the script name and table.
2. Determine intent. Is the property name a typo of a real property? Or is it a fabrication — the script was written assuming a property that was never registered?
3. For typos: correct the property name in the script. Re-run the scan; the reference should resolve.
4. For fabrications: decide whether the intended property should exist. If yes, register it in sys_properties with the appropriate baseline value. If no, remove the dead reference from the script.

A false-positive note: properties registered in scoped applications outside the global scope may not appear under the unqualified name. If a script in x_custom_app calls gs.getProperty('x_custom_app.my.prop'), the property may be registered under that scope but the check's lookup against global sys_properties may not find it. Review such cases in context.

How to verify the fix

/*
 * Verify nowisor-fabricated-property-references
 * Read-only, safe for production.
 * Sample-checks a specific property name's registration.
 */
(function checkProperty(propName) {
    var SENTINEL = '__NOT_REGISTERED__';
    var value = gs.getProperty(propName, SENTINEL);
    if (value === SENTINEL) {
        gs.print('[FAIL] ' + propName + ' is NOT REGISTERED in sys_properties.');
    } else {
        gs.print('[PASS] ' + propName + ' = "' + value + '"');
    }
})('your.property.name');  // <-- replace with the property to check

Use the script to confirm each remediated reference now resolves. Re-running the nowisor scan after corrections should show the check clean.

What to do next

The fabricated-property-references check is part of the operational-integrity cluster:

• nowisor-meta-active-check-coverage — confirms all 26 nowisor checks are installed and active. Pairs with this check: meta-coverage validates the check inventory; fabricated-property-references validates that the checks reference real data.
• nowisor-platform-build-drift — confirms the instance build matches the baseline nowisor was verified against. Property names change between ServiceNow releases; a drift finding here may explain a fabricated-property finding.

For nowisor's own development discipline, this check is the operationalized form of the 2-evidence verification rule: every property name in nowisor's scripts must be PDI-verified before shipping. The check confirms that discipline holds at runtime on your specific instance. See the operational-integrity view →