Sina Kheirkhah

Classification basis

The artifact is a complete Metasploit exploit module that performs authentication bypass and remote code execution. It includes a check method for vulnerability detection, but its primary purpose is exploitation: it injects session fields, promotes them, sets a root password, and opens an SSH command shell to deliver a payload. The module type is 'exploit' and the source metadata confirms it is an exploit.

Requirements

• Target must be running a vulnerable version of cPanel/WHM (after 11.40, before patched versions).modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:39-41
• Target must have WHM service accessible on the configured RPORT (default 2087) with SSL enabled.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:72-75
• Target must have SSH service accessible on the configured SSHPORT (default 22).modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:86
• DefangedMode must be set to false to allow the module to change the root password.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229

Observed behavior

• Mints a pre-auth session by sending a POST request to /login with random credentials and extracting the whostmgrsession cookie.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:95-112
• Injects session fields (user=root, hasroot=1, etc.) via a CRLF injection in the Basic-auth password, bypassing the encoder by omitting the ob-part of the session cookie.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134
• Promotes the injected fields into the authoritative session cache by requesting /scripts2/listaccts.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:136-146
• Verifies root WHM access by retrying a request to /json-api/version until a 200 response with version data is received.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:148-160
• Sets a temporary root password via the WHM JSON API passwd endpoint.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278
• Establishes an SSH connection as root using the temporary password and opens a command shell session.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-301
• Rotates the root password to a new random value after the SSH session is established.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:306-330
• Stores the rotated root credential in the Metasploit database.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:335-352

Observables

Exploit Behavior

Payload withheldThe module injects session fields via a crafted Basic-auth header to gain unauthorized root access, which is the core of the documented CVE-2026-41940 exploit.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134

Exploit Behavior

Payload withheldThe module uses the passwd API endpoint to set a temporary root password for SSH access, as described in the module's description.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278

Exploit Behavior

Payload withheldAfter setting the temporary password, the module connects via SSH, establishes a command stream, and rotates the root password to a new random value, as described.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-355

Safety Mechanism

Payload withheldThe module includes a DefangedMode option (default true) that must be explicitly set to false to proceed, preventing unintended password changes.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:90modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229

Classification basis

The module is a complete exploit that actively uploads and executes a payload on a vulnerable target. It constructs a malicious request with directory traversal, delivers a web shell or cron-based command execution, and triggers the payload to gain a session. This matches the 'exploit' classification as code intended to exercise a vulnerability for remote code execution.

Requirements

• Target must be running a vulnerable version of SmarterMail (before 100.0.9413).modules/exploits/multi/http/smartermail_guid_file_upload.rb:20
• The /api/upload endpoint must be accessible and accept multipart POST requests.modules/exploits/multi/http/smartermail_guid_file_upload.rb:114-119

Observed behavior

• Sends a multipart POST request to /api/upload with a contextData JSON field containing a 'guid' key with directory traversal sequences (e.g., '../' repeated) to place a file outside the intended upload directory.modules/exploits/multi/http/smartermail_guid_file_upload.rb:111
• On Windows, uploads an ASPX web shell that executes an attacker-supplied command via cmd.exe, then triggers it with an HTTP GET request.modules/exploits/multi/http/smartermail_guid_file_upload.rb:79-97modules/exploits/multi/http/smartermail_guid_file_upload.rb:135-142
• On Unix, uploads a raw command payload to /tmp and writes a cron job to /etc/cron.d that executes the payload every minute.modules/exploits/multi/http/smartermail_guid_file_upload.rb:144-156

Observables

Exploit Behavior

Payload withheldConsistent with module description of uploading a malicious ASPX web shell to the web root for RCE.modules/exploits/multi/http/smartermail_guid_file_upload.rb:133-136

Exploit Behavior

Payload withheldConsistent with module description of leveraging the upload vulnerability for RCE; cron job executes the uploaded payload.modules/exploits/multi/http/smartermail_guid_file_upload.rb:144-156

Exploit Behavior

Payload withheldMatches the CVE description of unsanitized guid key allowing directory traversal to upload files to arbitrary locations.modules/exploits/multi/http/smartermail_guid_file_upload.rb:111