SzafirHost Native Library Archive Signature Bypass Leading to RCE

Executive Summary

This vulnerability exists in SzafirHost's handling of downloaded native library archives. The system verifies the archive's signature using one method (JarFile parser reading the Central Directory), but extracts the native libraries using a different method (JarInputStream parser reading sequentially from local file headers). An attacker controlling the archive can insert a malicious library file as a local-file-header entry that is not listed in the Central Directory. Because the signature verification only checks the Central Directory, it does not detect this malicious entry. However, the extractor reads and extracts this malicious file, writing it to the native temp directory without any hash check. This discrepancy allows the attacker to bypass signature verification and potentially execute remote code.

Useful 0 Not Useful 0

Impact Analysis

The main impact of this vulnerability is the potential for remote code execution. An attacker who can serve a specially crafted archive can inject malicious native libraries that will be extracted and executed on the victim's system without detection. This can lead to unauthorized control over the affected system, data compromise, and further exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in SzafirHost was fixed in version 1.2.2.

To mitigate this vulnerability, you should immediately update SzafirHost to version 1.2.2 or later.

Useful 0 Not Useful 0