Shubham Shah Exploits and Proofs of Concept

Showing 3 PoCs on this page

Metasploit

cPanel/WHM CRLF Injection Authentication Bypass RCE

Metasploit exploitby Adam KuesAdded to Metasploit 2026-05-15ExploitCVE-2026-419401 file

exploit_multi/http/cpanel_whm_auth_bypass_rce · Ruby

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

A Metasploit module that exploits CVE-2026-41940, a CRLF injection vulnerability in cPanel/WHM's cpsrvd daemon, to achieve unauthenticated remote code execution as root. It bypasses authentication by injecting session fields via a crafted Basic-auth header, promotes them to the session cache, uses the WHM JSON API to set a temporary root password, and delivers a payload over SSH.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented exploit for CVE-2026-41940. It performs authentication bypass via CRLF injection, sets a temporary root password, delivers a payload over SSH, and rotates the password. All behavior is consistent with the stated exploit purpose and contains no concealed, deceptive, or unrelated harmful actions.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesRuby

Target softwarecPanelWHM

Attack typesauthentication bypassremote code executionCRLF injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that performs authentication bypass and remote code execution. It includes a check method for vulnerability detection, but its primary purpose is exploitation: it injects session fields, promotes them, sets a root password, and opens an SSH command shell to deliver a payload. The module type is 'exploit' and the source metadata confirms it is an exploit.

modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:11modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:222-355modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:24

Requirements

Target must be running a vulnerable version of cPanel/WHM (after 11.40, before patched versions).modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:39-41
Target must have WHM service accessible on the configured RPORT (default 2087) with SSL enabled.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:72-75
Target must have SSH service accessible on the configured SSHPORT (default 22).modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:86
DefangedMode must be set to false to allow the module to change the root password.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229

Observed behavior

Mints a pre-auth session by sending a POST request to /login with random credentials and extracting the whostmgrsession cookie.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:95-112
Injects session fields (user=root, hasroot=1, etc.) via a CRLF injection in the Basic-auth password, bypassing the encoder by omitting the ob-part of the session cookie.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134
Promotes the injected fields into the authoritative session cache by requesting /scripts2/listaccts.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:136-146
Verifies root WHM access by retrying a request to /json-api/version until a 200 response with version data is received.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:148-160
Sets a temporary root password via the WHM JSON API passwd endpoint.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278
Establishes an SSH connection as root using the temporary password and opens a command shell session.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-301
Rotates the root password to a new random value after the SSH session is established.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:306-330
Stores the rotated root credential in the Metasploit database.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:335-352

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: Payload withheldThe module injects session fields via a crafted Basic-auth header to gain unauthorized root access, which is the core of the documented CVE-2026-41940 exploit.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134
Exploit Behavior: Payload withheldThe module uses the passwd API endpoint to set a temporary root password for SSH access, as described in the module's description.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278
Exploit Behavior: Payload withheldAfter setting the temporary password, the module connects via SSH, establishes a command stream, and rotates the root password to a new random value, as described.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-355
Safety Mechanism: Payload withheldThe module includes a DefangedMode option (default true) that must be explicitly set to false to proceed, preventing unintended password changes.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:90modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229

Review boundaries

What the analysis did not establish

Analysis is based on module source code and metadata only; Metasploit framework mixins, libraries, and external payloads are not expanded.
The module's actual runtime behavior, reliability, and safety are not verified by execution.
Review is limited to the module source code and metadata; framework mixins, libraries, and external payloads are not expanded or analyzed.
Binary files are flagged as metadata-only and not analyzed, but no binary files are present in the evidence.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Metasploit