F5-K000162615: Medium severity F5 NGINX JavaScript (njs) vulnerability
NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.2
Event History
Frequently Asked Questions
Which deployments are confirmed to be affected?
An nginx-saml deployment using the built-in njs backend is a confirmed affected consumer. The issue is described as occurring in both the built-in njs and QuickJS backends during canonicalization.
What must an attacker be able to do to exploit this issue?
The attacker is unauthenticated but must invest significant effort to obtain a genuinely signed document. The crafted document uses an explicitly present XML attribute containing an internal entity reference, allowing validation to be skipped while signature verification succeeds.
What is the practical security impact?
In affected signature-validation flows, inconsistent handling of entity-backed XML attributes can cause validation to be skipped even though signature verification succeeds. The stated severity vector indicates high confidentiality impact and low integrity impact.