cpanel-sessionscribe - Detection, mitigation, and reverse-engineering too

项目说明

<di="center">

SessionScribe - C

Critical unauthenticated RCE in cPanel & WHM.
Four HTTP requests forge a root session via CRLF injection into the
password field of a preauth session.
No auth, no preconditions, every supported tier affected.
Disclosed 2026-04-28 by Sina Kheirkhah / watchTowr Labs.

<a href=" src=" alt="rfxn.com research article"></a>

![CVE]()
![Disclosed]()

Quickstart · ioc-scan · mitigate · remote-probe · Affected builds · Priority order

</div>

> [!IMPORTANT]
> Tiers 112, 114, 116, 120, 122, 128 have no patch. Every
> build on those tiers is ; upgrade or migrate is the only
> durable fix. Until then: firewall TCP/2082, 2083, 2086, 2087, 2095, 2096
> to management CIDRs (mitigate.sh --apply does this) and front the
> remaining surface with the ModSec rule pack.

---

Quickstart

Three oneliners, in operator priority order:

Exit codes are designed for fleet automation: ioc-scan exits 4 on
COMPROMISED, 1 on ; mitigate exits 0 clean / 1 applied
/ 2 manual / 3 tool error; remote-probe exits 2 if any target is
VULN.

---

Tools

In order of operational priority. Every artifact emits structured output
(--json / --jsonl / --csv) keyed on host, os, cpanel_,
ts for fleet roll-up.

| Tool | Role | Where it runs |
|---|---|---|
| sessionscribe-ioc-scan.sh | First-class triage. IOC ladder, code-state + host-state , kill-chain reconstruction, IR bundle. | on the cPanel host |
| sessionscribe-mitigate.sh | Close the window. Phased mitigation: patch check, firewall, proxysub, ModSec. | on the cPanel host |
| sessionscribe-remote-probe.sh | Supporting collateral. Non-destructi probe → VULN/SAFE per host. | anywhere with curl |
| modsec-sessionscribe.conf | ModSec rule pack deployed by mitigate. | Apache front-end |
| sessionscribe-revsnap.sh | Per-tier RE snapshot collector for binary diffing. | on the cPanel host, around upcp |

GPL v2. All artifacts curl-ready via the raw URLs above.

---

sessionscribe-ioc-scan.sh - IOC ladder + kill-chain

Run this first. Detection-only by default (fast, fleet-friendly);
add --full to run the forensic phases inline (defense timeline, offense
ingest, reconcile, kill-chain renderer, IR bundle).

Two axes report independently. code_ (PATCHED /
/ INCONCLUSIVE) comes from , Perl source patterns,
and cpsr fingerprint. host_ (CLEAN /
SUSPICIOUS / COMPROMISED) comes from the session-file IOC ladder,
access-log scan, and Patterns A–G destruction probes. **A patched host
can still exit 4 if prior exploitation left IOCs on disk.**

| Exit | Code-state | Host-state | Triage action |
|---|---|---|---|
| 0 | CLEAN/PATCHED | CLEAN | none |
| 1 | | (any) | patch cpsrvd |
| 2 | INCONCLUSIVE | (any) | manual code-state review (also: tool error) |
| 3 | (any) | SUSPICIOUS | review session/access logs |
| 4 | (any) | COMPROMISED | full IR; bundle + upload |

Sessions tagged with nxesec_canary_<nonce> (left by the remote probe)
bucket as PROBE_ARTIFACT and do not escalate to COMPROMISED.

Kill-chain output sample

--full collates every IOC against defense acti and classifies
each as PRE-DEFENSE, POST-DEFENSE, POST-PARTIAL, or
UNDEFENDED, then summarises with + defense-lag headline.
PRE-DEFENSE = host was open to the exploit when the indicator landed;
POST-DEFENSE = collateral or pre-mitigation noise.

<details>
<summary><b>Checks reference + forensic phases + bundle layout</b> (click to expand)</summary>

| Check | What it does |
|---|---|
| | cpanel -V vs the published patched-build list - drives code_ |
| static-pattern | Greps Cpanel/Session/*.pm for post-patch sentinel patterns (no-ob: decode branch) |
| cpsr | cpsr inspection against patched-build signatures |
| access-log | Apache + cpsrvd logs for exploitation traffic shapes (--no-logs to skip) |
| session-store | //sessions/raw/ walk: IOCs + 4-way co-occurrence + forged-timestamp heuristic (--no-sessions to skip) |
| destruction | Patterns A–G probes: /root/sshd encryptor, mysql-wipe, BTC index, nuclear.x86, sptadm reseller, __S_MARK__ har, suspect SSH keys (--no-destruction-iocs to skip) |
| probe (opt-in) | Single marker GET to 127.0.0.1:2087 - confirms cpsrvd is responsive. Does not attempt the bypass |

--full forensic phases (run inline after detection):

| Phase | What it does |
|---|---|
| defense | Timestamps every defense layer that landed: cpanel patch, cpsr, mitigate runs, ModSec rules, CSF/APF port closures, proxysub, upcp summary |
| offense | Timestamps every obser indicator (Patterns A–G + Pattern X CRLF-bypass chain) |
| reconcile | Per-indicator: was the relevant defense active when it first appeared? PRE-DEFENSE / POST-DEFENSE / POST-PARTIAL / UNDEFENDED + time delta |
| bundle | Tarball of raw artifacts under /root/.ic5790-forensic/<TS>-<RUN_ID>/, mode 0700 |

Bundle layout (/root/.ic5790-forensic/<TS>-<RUN_ID>/):

Typical bundle on a busy host with the 90-day window: ~250 MB – 2 GB compressed.
Per-tarball 2 GB cap (--max-bundle-mb) drops o candidates indi.

A run ledger is written to //sessionscribe-ioc/ by default
(--no-ledger to disable). --chain-forensic / --chain-on-critical /
--chain-upload are preserved as v1.x back-compat aliases.

Snapshot-testing o for offline forensics on extracted tarballs:
--root DIR, -- S, --cpsr P. See --help for
the full flag list.

</details>

---

sessionscribe-mitigate.sh - mitigation orchestrator

Read-only by default (--check). Add --apply to mutate state.
Idempotent: re-running on a healthy host is a no-op. Mutations write
timestamped backups under //sessionscribe-mitigation/
before touching any file.

| Phase | What it does |
|---|---|
| patch | cpanel -V vs the published patched-build list (incl. EL6 11.86.0.41, EL6/CL6 110.0.103, tier 124, WP² 136.1.7) |
| preflight | Removes /etc/yum.repos.d/threatdown.repo; ensures epel-release; disables broken non-base repos so upcp doesn't die mid-flight |
| upcp | If unpatched, kicks off /scripts/upcp --force --bg |
| proxysub | Enables proxysubdomains + new-account ; rebuilds httpd conf |
| csf / apf / runfw | Strips cpsr (2082/2083/2086/2087/2095/2096) from TCP_IN/TCP6_IN/IG_TCP_CPORTS; li INPUT chain |
| apache | httpd running + security2_module loaded |
| modsec | modsec2.user.conf contains rules 1500030 + 1500031; deploy if missing (timestamped backup, httpd -t , graceful reload) |
| probe (opt-in) | Runs sessionscribe-remote-probe.sh against 127.0.0.1 to confirm denials in practice |

CentOS / Alma / Rocky base/appstream/extras/updates/powertools repos
are never disabled by preflight, even if currently unreachable.

Exit codes

| Exit | Meaning |
|---|---|
| 0 | clean - patched + posture ok, no action needed |
| 1 | remediation applied successfully (--apply made changes) |
| 2 | manual inter required (warns in --check, fails in --apply) |
| 3 | tool error (bad args, missing dependencies, not root for --apply) |

Phase selection: --only LIST, --no-PHASE, --no-fw (shorthand for
--no-csf --no-apf --no-runfw). Output: --json / --jsonl / --csv,
-o FILE. See --help for the full flag list.

Sixty-second smoke check

The orchestrator detects a non-cPanel host and exits clean — proving
idempotency without needing a lab.

---

sessionscribe-remote-probe.sh - non-destructi probe

Supporting collateral. Runs the four-stage chain non-destructively
against a target: mint preauth → CRLF inject → propagate raw→cache →
via /json-api/, then actively logs out.
determining signal is the HTTP code at stage 4: 200, or 5xx with a
license body, is VULN; 401 or 403 is SAFE.

Every test session is tagged with an nxesec_canary_<nonce> attribute
for forensic cleanup, and no state-changing API calls are made.
Forged sessions are root-equi for ~1–3s between stage 3 and the
stage 5 logout — see the script header for the full safety model.

Output modes: pretty (default), -q/--quiet, --oneline, --csv,
--json. Exit codes: 0 no VULN found, 1 inconclusive only, 2
one or more VULN. See --help for full flag list including
--auto-host-discover, --all, --fingerprint-only semantics, and
the stage-2-only --no- mode (legacy, produces FPs on patched
hosts).

---

Supporting collateral

modsec-sessionscribe.conf - ModSecurity rule pack

Deployed automatically by mitigate.sh --apply --only modsec. Manual
install:

| Rule | Surface | Action |
|---|---|---|
| 1500030 | CRLF inside Authorization: Basic decoded payload | deny, all sources, all paths |
| 1500031 | whostmgrsession cookie missing valid ,OBHEX suffix | deny (defense-in-depth) |
| 1500010 | Authorization: WHM on /json-api/, /execute/, /acctxfer*/ | deny when source not in trust list |
| 1500020 | Authorization: WHM on WebSocket dispatch family | deny when source not in trust list |
| 1500021 | Authorization: WHM on SSE dispatch path | deny when source not in trust list |

ID range reserved: 1500000–1500099. WHM-token rules use
against an operator-defined trust list — edit the CIDRs at the top of
the file before deploying.

> [!IMPORTANT]
> These rules run inside Apache. cpsrvd listens directly on
> 2082/2083/2086/2087/2095/2096 and is reachable independent of Apache.
> Pair the rule pack with cpsr firewalling to management CIDRs.

sessionscribe-revsnap.sh - RE snapshot collector

Captures a per-tier tarball (binaries, strings, dynsym, disasm, Perl
modules, runtime layout) for binary diffing across cPanel upgrades.
Built around upcp to capture pre/post-patch pairs.

Generalises beyond SessionScribe: every future cpsrvd CVE will land in
roughly the same surface, and a tarball pair for the pre-patch and
patched build is the difference between hours and days of analysis.
See the research article
for the full RE walkthrough.

---

Fleet usage

> [!TIP]
> Every artifact emits structured output (--json, --jsonl, --csv)
> with host, os, cpanel_, ts on every record. Designed
> for pdsh | jq or ansible -m script roll-up across hundreds of
> hosts in one pass.

Same curl-piped-bash primitive — let each host fetch and exec the latest
script directly:

The probe is independently fleet-safe (canary-tagged sessions, active
logout, no state-changing API calls). The on-host scripts respect
--quiet + structured-output flags so stdout is parser-clean.

---

The chain

Four HTTP requests, no auth, no preconditions:

is the HTTP code at request 4. The on-disk session file at
//sessions/raw/<sessname> is the only post-hoc forensic
artifact. The full primitive (the two composing asymmetries —
filter_sessiondata not on every write path, encoder short-circuits
on missing ob_part) and the architectural argument for proxy-endpoint
enforcement are in the
research article.

---

Indicators of compromise

Forged session-file shape (//sessions/raw/<sessname> after
exploitation):

A normal preauth session ne pass=, hasroot=1,
user=root, tfa_=1, or
successful_internal_auth_with_timestamp=. Any of those combined with
origin_as_string=…method=badpass is diagnostic. A forged-timestamp
value beyond now+365d (e.g. 9999999999) is independently diagnostic.

Access-log signal: successful 200/302/307 responses on
/json-api/, /execute/, or /scripts2/ paths from non-baseline
source IPs without a preceding /login/ 200 in the same session
window.

---

Affected builds

Tiers excluded from the patch list have no in-place fix: 112,
114, 116, 120, 122, 128. Hosts on those tiers must be upgraded to a
patched major series, migrated, or ha cpsr
firewalled until they are.

11.86.0.41 (EL6/CL7) was added in the 04/29 ad re; 11.130
was bumped from .18 to .19 in the same re. A subsequent
re added 11.124.0.35 (closing the prior gap on tier 124) and
110.0.103 as a direct upgrade target for EL6/CL6 hosts still on
v110.0.50.

---

Priority order

Immediate

Run sessionscribe-ioc-scan.sh fleet-wide. **A patched host can still

be compromised.**

Patch to the build for your tier (above).

If the tier has no patch, firewall TCP/2082, 2083, 2086, 2087, 2095,

2096 to management CIDRs immediately. Plan an upgrade or migration.

Forward

Enable proxy subdomains so cPanel/WHM/Webmail are reachable through

Apache on 80/443.

Deploy modsec-sessionscribe.conf into modsec2.user.conf with the

trust list set.

Firewall TCP/2082, 2083, 2086, 2087, 2095, 2096 to management CIDRs

only. Apache + ModSecurity becomes the sole public ingress.

Standardise this proxy-endpoint posture as the default. The next

cpsr will land on the same six ports.

The architectural case for proxy-endpoint enforcement is the closing
third of the
research article.

---

What this toolkit does NOT do

Not a patch. Does not modify cpsrvd, cpsrvd.so, or

Cpanel/Session/*.pm. The cpanel-issued back-port for your tier is
the real fix.

Not a fix for tiers 112, 114, 116, 120, 122, 128. No patch

exists. The orchestrator's proxysub + firewall phases plus the
ModSec rule pack reduce blast radius; upgrade or migration is the only
durable answer.

Not a replacement for port lockdown. ModSec rules fire only on

traffic that tra Apache. Pair the rule pack with cpsr
firewalling.

Not exploit code. The remote probe issues no state-changing API

calls, tags every test session with an nxesec_canary_<nonce>
attribute for cleanup, and actively logs out.

Not an IR substitute. ioc-scan finds artifacts of prior

exploitation; it does not remediate them. Treat its COMPROMISED
as a trigger for full IR, not a conclusion.

---

Reporting

> [!TIP]
> Found a bug, missed IOC, false positive, or have ops feedback?
> Open a GitHub issue -
> bug reports, IOC seen in the wild, detection misses on
> patched/unpatched hosts, ModSec rule false positives, and general
> operator feedback are all welcome.
>
> Sensiti (li e, customer data,
> no chains not yet public) should go via
> Keybase or email,
> not GH Issues.

---

References

Research article (full writeup): rfxn.com/research/cpanel-sessionscribe-c

ad: cPanel KB 671

Researcher writeup: watchTowr Labs

Public PoC: watchtowrlabs/watchTowr--to-RCE.py

Source: github.com/rfxn/cpanel-sessionscribe

License

GPL v2. See indi file headers.

---

*Forged during the SessionScribe incident response - Ryan MacDonald, R-fx Networks.*

项目信息

开发语言：Shell

Star 数：13

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Detection, mitigation, and reverse-engineering tooling for CVE-2026-41940 (SessionScribe): the cPanel/WHM unauthenticated session-forgery vulnerability disclosed 2026-04-28. Defense-in-depth active mitigation shim, ModSec rule pack, remote probe, on-host IOC scanner, and per-tier RE snapshot collector. GPL v2.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。