CVE-2026-41940 cPanel／WHM 认证绕过漏洞分析

1
sub new {
2
    my ( $class, $session, $check_expiration ) = @_;
3

4
    if ( $check_expiration ? !Cpanel::Session::Load::session_exists_and_is_current($session) : !Cpanel::Session::Load::session_exists($session) ) {
5
        die "The session  ^`^|$session ^`^} does not exist";
6
    }
7

8
    Cpanel::Session::Load::get_ob_part( \$session );    # strip ob_part
9

10
    my $session_file = Cpanel::Session::Load::get_session_file_path($session);
11

12
    # Cpanel::Transaction not available here due to memory constraints
13
    my ( $ref, $fh, $conflock ) = Cpanel::Config::LoadConfig::loadConfig( // (1)
14
        $session_file,
15
        undef,
16
        '=',
17
        undef,
18
        0,
19
        0,
20
        { 'skip_readable_check' => 1, 'nocache' => 1, 'keep_locked_open' => 1, 'rw' => 1 } // (2)
21
    );
22

23
    return bless {
24
        '_session' => $session,
25
        '_fh'      => $fh,
26
        '_lock'    => $conflock,
27
        '_data'    => Cpanel::Session::decode_origin($ref),
28
    }, $class;
29
}

1
sub do_token_denied {
2
    my ($error_msg, $form_ref, $goto_uri, $use_theme) = @_;
3
    ...
4
    my $max_tries = 3;
5
    if ($user_provided_session_ref = $server_obj->get_current_session_ref_if_exists) {
6
        my $session = $server_obj->get_current_session;
7
        if (not $server_obj->request->get_supplied_security_token
8
            or ++$user_provided_session_ref->{'token_denied'} < $max_tries)
9
        {
10
            require Cpanel::Session::Modify;
11
            my $session_mod = 'Cpanel::Session::Modify'->new($session);     # (1)
12
            $session_mod->set('token_denied',
13
                defined $session_mod->get('token_denied')
14
                ? $session_mod->get('token_denied') + 1
15
                : 1
16
            );
17
            $session_mod->save;                                             # (2)
18
            $another_try = 1;
19
        }
20
    }
21
    ...
22
}

1
sub check_security_token {
2
    ...
3
    if (not $server_obj->request->get_supplied_security_token) {
4
        $failmsg = 'security token missing';
5
    }
6
    elsif ($ENV{'cp_security_token'} ne $server_obj->request->get_supplied_security_token)  { // (1)
7
        $failmsg = 'security token incorrect';
8
    }
9
    if ($failmsg) {
10
        if ($is_login_url) {
11
            $server_obj->badpass(...);
12
        }
13
        else {
14
            failedlogin($failmsg, 1);
15
            $server_obj->connection->set_is_last_request(1);
16
            do_token_denied($failmsg);                       # (2)
17
        }
18
        ...
19
}

1
handle_form_login();
2
…
3
handle_auth();
4

5
my $authtype   = $server_obj->auth->get_auth_type || '';
6
my $document   = $server_obj->request->get_document;
7
$user          = $server_obj->auth->get_user;
8
my $pass       = $server_obj->auth->get_pass;
9
…
10
if ($Cpanel::App::appname eq 'whostmgrd') {
11
    …
12
    docheckpass_whostmgrd(
13
        'user' => $user,
14
        'pass' => $pass,
15
        …
16
    );
17
    …
18
}

1
sub check_authok_user {
2
    my (%AUTHOPTS) = @_;
3
    …
4
    if ($AUTHOPTS{'authable_user'}{'successful_external_auth_with_timestamp'}
5
        or $AUTHOPTS{'authable_user'}{'successful_internal_auth_with_timestamp'})
6
    {
7
        return $Cpanel::Server::AUTH_OK, 0;            # <-- /etc/shadow never consulted
8
    }
9
    elsif (Cpanel::CheckPass::UNIX::checkpassword(
10
            $AUTHOPTS{'password'},
11
            $AUTHOPTS{'authable_user'}{'encrypted_pass'}))
12
    {
13
        …
14
    }
15
}