Sachinart/CVE-2026-41940-cpanel-0day

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based defensive posture scanner for cPanel/WHM that checks for exposure to the CVE-2026-41940 authentication bypass vulnerability. It performs unauthenticated network probes (DNS, TLS, HTTP) and optional SSH-based configuration audits to determine if the proxy-subdomain attack chain is reachable, but does not attempt to exploit the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a defensive posture scanner for CVE-2026-41940. The Python script performs unauthenticated network probes and optional SSH-based configuration audits to assess exposure to the proxy-subdomain attack chain. No backdoor, deceptive payload, or concealed harmful behavior was observed. The code explicitly avoids sending credentials or performing exploitation.

ClassificationScanner
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwarecPanelWHM
Attack typesauthentication_bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a scanner. The README explicitly states 'THIS IS A SCANNER REAL ONE' and the script's docstring declares 'cPanel defensive posture scanner' with 'No exploit attempts. No credentials sent.' The code only performs detection and validation checks (DNS, TLS, HTTP fingerprinting, SSH config audits) to assess exposure to CVE-2026-41940 without exercising the vulnerability.

README.md:13cpanel-0day.py:3-17

Requirements

  • Target hostname or IP addresscpanel-0day.py:1521-1524
  • Python 3 with optional libraries (paramiko for SSH mode, requests, dnspython, cryptography)cpanel-0day.py:32-58

Observed behavior

  • Resolves proxy subdomains (cpanel, whm, webmail, webdisk) via DNS and checks HTTPS reachability on port 443cpanel-0day.py:132-155
  • Performs unauthenticated HTTP GET requests to / and /login/ on proxy subdomains to fingerprint cpsrvd indicators (Server header, security_token, cpsess, session cookies)cpanel-0day.py:197-299
  • Probes cpsrvd-specific URL patterns and WebDAV PROPFIND to confirm backend identity without credentialscpanel-0day.py:360-415cpanel-0day.py:459-493
  • Optionally connects via SSH to audit Apache modules, vhosts, ProxyPass rules, and header trust directives, and performs a passive proxy-hop verification using a single curl from the targetcpanel-0day.py:642-788
  • Classifies targets into risk levels (SECURE, AT_RISK, EXPOSED) based on collected evidence and outputs results to console and CSVcpanel-0day.py:971-1170
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Probe
GET /login/ and other unauthenticated HTTP requests to target hostsThe scanner issues unauthenticated GET requests to fingerprint cpsrvd and assess the proxy chain. This is documented as passive scanning and does not constitute a backdoor.cpanel-0day.py:197-245cpanel-0day.py:248-299
Ssh Command
curl -sk -A '<marker>' --max-time 10 -o /dev/null -w 'http_code=%{http_code}' https://cpanel.<host>/login/In SSH mode, the scanner executes a single passive curl from the target to verify the proxy hop. This is a diagnostic step, not a backdoor or payload delivery.cpanel-0day.py:754-788
Ssh Command
grep -h '<marker>' /usr/local/apache/logs/access_log ...The scanner checks Apache access logs for the marker left by the proxy-hop verification curl. This is part of the diagnostic chain and does not exfiltrate data or establish persistence.cpanel-0day.py:770-776
Review boundaries

What the analysis did not establish

  • Evidence is limited to the two text files (README.md and cpanel-0day.py) provided in the packet. No binary files, network captures, or execution logs are included.
  • The artifact's self-description as a scanner is taken at face value; no dynamic analysis was performed to confirm it does not contain hidden exploit logic.
  • Only the two text files (README.md and cpanel-0day.py) were provided for review. No binary files were present in the evidence packet.
  • The review is limited to static analysis of the supplied source code; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1