CVE-2021-21276 Privilege escalation in Polr
Attackers can gain admin access to Polr instances by crafting specific cookie headers to the setup endpoint, bypassing authentication checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21276?
CVE-2021-21276 is a critical vulnerability in cydrobolt polr, published on 1 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a request with specific cookie headers to the /setup/finish endpoint, they may be able to obtain admin privileges on the instance. This is caused by a loose comparison (==) in SetupController that is susceptible to attack. The project has been patched to ensure that a strict comparison (===) is used to verify the setup key, and that /setup/finish verifies that no users table exists before performing any migrations or provisioning any new accounts. This is fixed in version 2.3.0. Users can patch this vulnerability without upgrading by adding abort(404) to the very first line of finishSetup in SetupController.php.
Weakness: CWE-863
Which versions are affected by CVE-2021-21276?
It affects 1 product.
Products include Polrproject Polr.
How do I fix CVE-2021-21276?
No fix has been published for CVE-2021-21276 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21276 being exploited?
There is no known exploitation of CVE-2021-21276 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-vg6w-8w9v-xxqc.