Krajowa Izba Rozliczeniowa SzafirHost Remote Code Execution Vulnerability

A remote code execution vulnerability exists in SzafirHost versions prior to 1.2.1. The issue arises because SzafirHost verifies the signature of downloaded JAR files using JarInputStream, which reads from the beginning of the file. However, it loads classes using JarFile and URLClassLoader, which read the Central Directory from the end of the file. This discrepancy allows an attacker to combine a legitimate, signed JAR file with a malicious ZIP file, bypassing signature verification and leading to the execution of malicious code.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where SzafirHost is running.

Remediation

Users can upgrade to SzafirHost version 1.2.1 or later to address this vulnerability.