Krajowa Izba Rozliczeniowa
Monthly
Remote code execution in SzafirHost (KIR's Szafir electronic-signature host application) arises from a ZIP/JAR parser-confusion flaw: signature verification reads the archive's Central Directory while extraction reads local file headers sequentially, letting an attacker who controls the served native-library archive smuggle an unsigned malicious DLL/SO/DYLIB past the signature check. Versions prior to 1.2.2 are affected; the injected library is written to the native temp directory and loaded, yielding code execution on the victim's machine. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Signature verification bypass in Krajowa Izba Rozliczeniowa (KIR) Szafir SDK before version 463 causes the SDK to return a 'Positively verified' success result (Result/@code == 0) even when the signer's certificate trust could not be established (certificateType == 'nondetermined'). Consuming applications that rely on this result for authentication accept forged or untrusted-chain signatures as valid, enabling authentication bypass and user impersonation. There is no public exploit identified at time of analysis and EPSS probability is low (0.04%), but CISA's SSVC framework rates the technical impact as total and the flaw as automatable.
Remote code execution in SzafirHost before 1.2.1 allows unauthenticated attackers to bypass JAR signature verification through a ZIP file smuggling technique. The vulnerability exploits a discrepancy between verification logic (JarInputStream reading from file beginning) and class loading (JarFile/URLClassLoader reading Central Directory from file end), enabling attackers to combine a legitimately signed JAR with malicious classes. CERT-PL confirmed this vulnerability, and the vendor released patch version 1.2.1. EPSS data not available, not listed in CISA KEV, requiring user interaction (UI:A) for exploitation.
Remote code execution in SzafirHost (KIR's Szafir electronic-signature host application) arises from a ZIP/JAR parser-confusion flaw: signature verification reads the archive's Central Directory while extraction reads local file headers sequentially, letting an attacker who controls the served native-library archive smuggle an unsigned malicious DLL/SO/DYLIB past the signature check. Versions prior to 1.2.2 are affected; the injected library is written to the native temp directory and loaded, yielding code execution on the victim's machine. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Signature verification bypass in Krajowa Izba Rozliczeniowa (KIR) Szafir SDK before version 463 causes the SDK to return a 'Positively verified' success result (Result/@code == 0) even when the signer's certificate trust could not be established (certificateType == 'nondetermined'). Consuming applications that rely on this result for authentication accept forged or untrusted-chain signatures as valid, enabling authentication bypass and user impersonation. There is no public exploit identified at time of analysis and EPSS probability is low (0.04%), but CISA's SSVC framework rates the technical impact as total and the flaw as automatable.
Remote code execution in SzafirHost before 1.2.1 allows unauthenticated attackers to bypass JAR signature verification through a ZIP file smuggling technique. The vulnerability exploits a discrepancy between verification logic (JarInputStream reading from file beginning) and class loading (JarFile/URLClassLoader reading Central Directory from file end), enabling attackers to combine a legitimately signed JAR with malicious classes. CERT-PL confirmed this vulnerability, and the vendor released patch version 1.2.1. EPSS data not available, not listed in CISA KEV, requiring user interaction (UI:A) for exploitation.