Authentication Bypass in NGINX JavaScript and QuickJS Engines

The NGINX JavaScript (njs) and QuickJS (qjs) engines contain a vulnerability involving the js_access handler during asynchronous request body processing. When an exception occurs during the asynchronous access-control evaluation phase - specifically before the handler can return an explicit access denial - the engine may fail open. This misconfiguration in the access validation logic permits the request to proceed to downstream resources despite failing security checks.

An unauthenticated remote attacker can exploit this condition by sending a crafted HTTP request designed to trigger an error within the access-control JavaScript logic. This results in an authorization bypass, potentially allowing access to protected endpoints that should have been restricted. This vulnerability exists within the data plane, impacting any application relying on the njs or qjs access control handlers for security enforcement.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass security controls defined within the js_access handler. This can result in unauthorized access to sensitive application data or protected administrative functions. As this is a data plane issue affecting request processing, it does not involve exposure of the server control plane but directly undermines the security posture of the web application.

Recommendation

• Identify all instances of NGINX utilizing the js_access handler for security controls.
• Audit JavaScript access control logic to ensure that error conditions do not result in a default-allow state.
• Monitor web server error logs for unexpected exceptions occurring within JavaScript access handlers, which may indicate exploitation attempts.
• Apply patches provided by the software vendor once available for NGINX and affected distributions.