آسیب‌پذیری بحرانی CVE-2026-41940 در cPanel و WHM — راهنمای وصله و شناسایی نفوذ

/scripts/upcp --force

/usr/local/cpanel/cpanel -V
/scripts/restartsrv_cpsrvd

whmapi1 configureservice service=cpsrvd enabled=0 monitored=0 && \
whmapi1 configureservice service=cpdavd enabled=0 monitored=0 && \
/scripts/restartsrv_cpsrvd --stop && \
/scripts/restartsrv_cpdavd --stop

/bin/bash ./ioc_checksessions_files.sh

#!/bin/bash
# Scan for compromised session files

SESSIONS_DIR="/var/cpanel/sessions"
COMPROMISED=0

echo "[*] Scanning session files for injection indicators..."

for session_file in "$SESSIONS_DIR"/raw/*; do
    [ -f "$session_file" ] || continue
    session_name=$(basename "$session_file")
    preauth_file="$SESSIONS_DIR/preauth/$session_name"

    # IOC 0: token_denied + cp_security_token با منشأ badpass
    if grep -q '^token_denied=' "$session_file" && \
       grep -q '^cp_security_token=' "$session_file"; then

        token_val=$(grep '^cp_security_token=' "$session_file" | head -1 | cut -d= -f2)
        denied_val=$(grep '^token_denied=' "$session_file" | head -1 | cut -d= -f2)
        origin=$(grep '^origin_as_string=' "$session_file" | head -1 | cut -d= -f2-)
        used=$(grep -a "$token_val" /usr/local/cpanel/logs/access_log | grep -m1 " 200 ")
        external_auth=$(grep '^successful_external_auth_with_timestamp=' "$session_file")

        if grep -q '^origin_as_string=.*method=badpass' "$session_file"; then
            if [ -z "$external_auth" ] && [ -z "$used" ]; then
                echo "Found possible injected session file: $session_file"
                echo "  - No sign of usage"
            else
                echo "[!] CRITICAL: Exploitation artifact - token_denied with injected cp_security_token: $session_file"
                echo "    - cp_security_token=$token_val"
                echo "    - token_denied=$denied_val"
                echo "    - origin=$origin"
                echo "    - Verdict: Session was pre-auth (badpass origin) with attacker-injected token"
                echo "    - USED:  $used"
                COMPROMISED=1
            fi
        else
            echo "[!] WARNING: Suspicious session with token_denied + cp_security_token: $session_file"
        fi
    fi

    # IOC 1: Pre-auth session با ویژگی‌های Session احراز هویت‌شده
    if [ -f "$preauth_file" ]; then
        if grep -qE '^successful_external_auth_with_timestamp=' "$session_file"; then
            echo "[!] CRITICAL: Injected session detected: $session_file"
            COMPROMISED=1
        fi
    fi

    # IOC 2: tfa_verified=1 بدون منشأ ورود معتبر
    if grep -q '^tfa_verified=1' "$session_file" && \
       ! grep -q '^origin_as_string=.*method=handle_form_login' "$session_file" && \
       ! grep -q '^origin_as_string=.*method=create_user_session' "$session_file" && \
       ! grep -q '^origin_as_string=.*method=handle_auth_transfer' "$session_file"; then
        echo "[!] WARNING: Session with tfa_verified but suspicious origin: $session_file"
        COMPROMISED=1
    fi

    # IOC 3: Newline در مقدار pass
    if grep -qzP '(?m)^pass=.*\n.' "$session_file" 2>/dev/null; then
        echo "[!] CRITICAL: Multi-line pass value detected: $session_file"
        COMPROMISED=1
    fi
done

if [ "$COMPROMISED" -eq 0 ]; then
    echo ""
    echo "[+] No indicators of compromise found."
else
    echo ""
    echo "[!] INDICATORS OF COMPROMISE DETECTED - IMMEDIATE ACTION REQUIRED"
    echo "    1. Purge all affected sessions"
    echo "    2. Force password reset for root and all WHM users"
    echo "    3. Audit /var/log/wtmp and WHM access logs for unauthorized access"
    echo "    4. Check for persistence mechanisms (cron, SSH keys, backdoors)"
fi

[*] Scanning session files for injection indicators...
[!] CRITICAL: Exploitation artifact - token_denied with injected cp_security_token:
    /var/cpanel/sessions/raw/:Q3f8Ag2epeBuTaIZ
    - cp_security_token=/cpsess04396539398
    - token_denied=1
    - origin=address=100.96.3.23,app=whostmgrd,method=badpass
    - Verdict: Session was pre-auth (badpass origin) with attacker-injected token

[!] WARNING: Session with tfa_verified but suspicious origin:
    /var/cpanel/sessions/raw/:Q3f8Ag2epeBuTaIZ

[!] INDICATORS OF COMPROMISE DETECTED - IMMEDIATE ACTION REQUIRED
    1. Purge all affected sessions
    2. Force password reset for root and all WHM users
    3. Audit /var/log/wtmp and WHM access logs for unauthorized access
    4. Check for persistence mechanisms (cron, SSH keys, backdoors)