cPanel/WHM CRLF Injection Authentication Bypass RCE

Classification basis

The artifact is a complete Metasploit exploit module that performs authentication bypass and remote code execution. It includes a check method for vulnerability detection, but its primary purpose is exploitation: it injects session fields, promotes them, sets a root password, and opens an SSH command shell to deliver a payload. The module type is 'exploit' and the source metadata confirms it is an exploit.

Requirements

• Target must be running a vulnerable version of cPanel/WHM (after 11.40, before patched versions).modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:39-41
• Target must have WHM service accessible on the configured RPORT (default 2087) with SSL enabled.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:72-75
• Target must have SSH service accessible on the configured SSHPORT (default 22).modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:86
• DefangedMode must be set to false to allow the module to change the root password.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229

Observed behavior

• Mints a pre-auth session by sending a POST request to /login with random credentials and extracting the whostmgrsession cookie.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:95-112
• Injects session fields (user=root, hasroot=1, etc.) via a CRLF injection in the Basic-auth password, bypassing the encoder by omitting the ob-part of the session cookie.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134
• Promotes the injected fields into the authoritative session cache by requesting /scripts2/listaccts.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:136-146
• Verifies root WHM access by retrying a request to /json-api/version until a 200 response with version data is received.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:148-160
• Sets a temporary root password via the WHM JSON API passwd endpoint.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278
• Establishes an SSH connection as root using the temporary password and opens a command shell session.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-301
• Rotates the root password to a new random value after the SSH session is established.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:306-330
• Stores the rotated root credential in the Metasploit database.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:335-352

Observables

Exploit Behavior

CRLF injection to bypass authentication and gain root WHM accessThe module injects session fields via a crafted Basic-auth header to gain unauthorized root access, which is the core of the documented CVE-2026-41940 exploit.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134

Exploit Behavior

Sets a temporary root password via WHM JSON APIThe module uses the passwd API endpoint to set a temporary root password for SSH access, as described in the module's description.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278

Exploit Behavior

Delivers payload over SSH and rotates the temporary passwordAfter setting the temporary password, the module connects via SSH, establishes a command stream, and rotates the root password to a new random value, as described.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-355

Safety Mechanism

DefangedMode option prevents accidental exploitationThe module includes a DefangedMode option (default true) that must be explicitly set to false to proceed, preventing unintended password changes.modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:90modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229