Vulnerabilities

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server.

Szafir is vulnerable to Path Traversal in the uploaded filename.

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection.

SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native libraries with JarInputStream parser (reading sequentially from local file headers).

For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trus…

SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from t…

SzafirHost downloads necessary files in the context of the initiating web page.

Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched.