CVE-2021-21276
📋 TL;DR
CVE-2021-21276 is a critical authentication bypass vulnerability in Polr URL shortener that allows unauthenticated attackers to gain administrative access by exploiting a loose comparison flaw in the setup process. All Polr instances running versions before 2.3.0 are affected regardless of configuration settings. Attackers can craft malicious requests to the /setup/finish endpoint to take over the admin account.
💻 Affected Systems
- Polr URL Shortener
📦 What is this software?
Polr by Polrproject
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Polr instance with attacker gaining full administrative control, allowing them to modify all shortened URLs, steal analytics data, redirect legitimate traffic to malicious sites, and potentially pivot to other systems.
Likely Case
Attackers gain admin access and use the platform for phishing campaigns by modifying existing shortened URLs to point to malicious destinations, compromising all users who click on previously trusted links.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the Polr instance itself, though administrative control loss still represents significant business risk.
🎯 Exploit Status
Exploit requires crafting specific cookie headers to the /setup/finish endpoint. Public exploit code is available in Packet Storm references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.0
Vendor Advisory: https://github.com/cydrobolt/polr/security/advisories/GHSA-vg6w-8w9v-xxqc
Restart Required: Yes
Instructions:
1. Upgrade to Polr version 2.3.0 or later. 2. Replace loose comparison (==) with strict comparison (===) in SetupController.php. 3. Ensure /setup/finish verifies no users table exists before performing migrations or provisioning accounts.
🔧 Temporary Workarounds
Manual code patch without upgrade
allAdd abort(404) to the first line of finishSetup function in SetupController.php to block exploitation
Edit SetupController.php and add 'abort(404);' as the first line in the finishSetup function
Block setup endpoint access
linuxRestrict access to /setup/* endpoints via web server configuration or firewall rules
# Apache: <Location "/setup/"> Require all denied </Location>
# Nginx: location /setup/ { deny all; }
🧯 If You Can't Patch
- Immediately restrict network access to Polr instance using firewall rules to limit exposure
- Implement strict monitoring on /setup/finish endpoint access and alert on any requests to this path
🔍 How to Verify
Check if Vulnerable:
Check if Polr version is below 2.3.0 and if /setup/finish endpoint is accessible without proper authenticationCheck Version:
Check Polr version in admin panel or examine composer.json fileVerify Fix Applied:
Verify Polr version is 2.3.0 or higher, and test that /setup/finish endpoint properly validates setup key with strict comparison📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /setup/finish endpoint with crafted cookie headers
- Unusual admin account creation or login events
Network Indicators:
- POST requests to /setup/finish with specific cookie patterns
- Unusual traffic patterns following setup endpoint access
SIEM Query:
source="web_server" AND (url_path="/setup/finish" OR user_agent CONTAINS "polr")🔗 References
- http://packetstormsecurity.com/files/171743/POLR-URL-2.3.0-Shortener-Admin-Takeover.html
- https://github.com/cydrobolt/polr/commit/b1981709908caf6069b4a29dad3b6739c322c675
- https://github.com/cydrobolt/polr/releases/tag/2.3.0
- https://github.com/cydrobolt/polr/security/advisories/GHSA-vg6w-8w9v-xxqc
- http://packetstormsecurity.com/files/171743/POLR-URL-2.3.0-Shortener-Admin-Takeover.html
- https://github.com/cydrobolt/polr/commit/b1981709908caf6069b4a29dad3b6739c322c675
- https://github.com/cydrobolt/polr/releases/tag/2.3.0
- https://github.com/cydrobolt/polr/security/advisories/GHSA-vg6w-8w9v-xxqc
