SzafirHost vulnerabilities

A vulnerability in SzafirHost allows an attacker to inject a malicious native library into a JAR archive that is signed and verified. The signature verification uses a JarFile parser (reading the Central Directory), while extraction uses a JarInputStream parser (reading sequentially from local file headers). An attacker can insert a library entry between the last legitimate entry and the Central Directory, which is not seen by the signature verifier but is read and written by the extractor, leading to remote code execution.

SzafirHost verifies the signature of the downloaded JAR file, but loads classes in a way that can lead to remote code execution. An attacker can combine a genuine, signed JAR file with a malicious ZIP file, allowing the malicious class to be loaded despite successful verification.

A vulnerability in SzafirHost is due to lack of hash or digital signature verification for DLL, SO, JNILIB, or DYLIB files. An attacker can provide a malicious file that gets saved in the temp folder and executed by the application. Fixed in version 1.1.0.