Critical · published February 1, 2021
🚨 Admin access is just a cookie header away! In Polr versions before 2.3.0, attackers can gain admin privileges during the setup phase without even having an account. 🔥 Imagine a hotel where anyone can waltz into the admin office just by slipping the receptionist a cleverly crafted note that looks official. In this case, the note is the manipulated cookie header that tricks the system into thinking the attacker has the right keys to the kingdom. With this vulnerability, an attacker could exploit the setup process to gain full control over your Polr instance. This means they could delete URLs, manipulate data, or even lock you out entirely, leaving your users in the lurch. The consequences could be absolutely devastating for your site's integrity and trustworthiness.
Imagine a hotel where anyone can waltz into the admin office just by slipping the receptionist a cleverly crafted note that looks official. In this case, the note is the manipulated cookie header that tricks the system into thinking the attacker has the right keys to the kingdom. The issue stems from a loose comparison (==) in the SetupController, allowing attackers to bypass authentication checks when accessing the /setup/finish endpoint. The patched version ensures a strict comparison (===) is used and that checks are in place to confirm no user accounts exist before setup proceeds.
With this vulnerability, an attacker could exploit the setup process to gain full control over your Polr instance. This means they could delete URLs, manipulate data, or even lock you out entirely, leaving your users in the lurch. The consequences could be absolutely devastating for your site's integrity and trustworthiness. To secure your instance, update Polr to version 2.3.0 as soon as possible. Alternatively, if you can't upgrade right now, add `abort(404)` to the very first line of `finishSetup` in `SetupController.php` to block unauthorized access. Make this a priority! You've got this! Follow these steps, and you'll strengthen your defenses like a true security hero! 🛡️