CVE-2026-41940: WebPros cPanel & WHM / WP2 Missing Authentication for Critical Function

union isfuzzy=true
(
    W3CIISLog
    | where csUriStem has_any ("/cpsess", "/json-api", "/execute", "/wp-json", "/xmlapi")
      and (csMethod == "POST" or csMethod == "GET")
      and (csUriStem has_any ("createacct", "removeacct", "passwd", "addpkg", "suspendacct", "unsuspendacct", "installplugin", "createuser"))
      and (sc_status between (200 .. 299) or sc_status == 301)
      and isempty(csUsername) or csUsername == "-"
    | extend TargetHost = csHost, AttackerIP = cIP, RequestPath = csUriStem, ResponseCode = sc_status
    | project TimeGenerated, AttackerIP, TargetHost, RequestPath, ResponseCode, csMethod, csUserAgent
),
(
    AzureDiagnostics
    | where Category == "ApplicationGatewayAccessLog"
      and requestUri_s has_any ("/json-api", "/execute", "/xmlapi", "/wp-json")
      and requestUri_s has_any ("createacct", "passwd", "installplugin", "addpkg")
      and httpStatus_d between (200 .. 299)
    | extend AttackerIP = clientIP_s, RequestPath = requestUri_s, ResponseCode = httpStatus_d
    | project TimeGenerated, AttackerIP, RequestPath, ResponseCode
)
| summarize RequestCount = count(), DistinctPaths = dcount(RequestPath), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by AttackerIP
| where RequestCount >= 1
| extend RiskScore = iif(RequestCount >= 5, "High", "Medium")
| sort by RequestCount desc

index=web sourcetype IN ("iis", "apache:access", "nginx:access", "cpanel:access")
(uri="*/json-api/*" OR uri="*/execute/*" OR uri="*/xmlapi/*" OR uri="*/cpsess*" OR uri="*/wp-json/*")
(uri="*createacct*" OR uri="*removeacct*" OR uri="*passwd*" OR uri="*addpkg*" OR uri="*suspendacct*" OR uri="*installplugin*" OR uri="*createuser*" OR uri="*unsuspendacct*")
status IN ("200", "201", "301", "302")
| eval auth_header=if(isnull(cs_username) OR cs_username="-", "missing", "present")
| where auth_header="missing"
| stats count AS request_count, dc(uri) AS distinct_endpoints, values(uri) AS endpoints, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, dest, http_method
| where request_count >= 1
| eval risk=case(request_count>=10, "critical", request_count>=3, "high", true(), "medium")
| eval cve="CVE-2026-41940"
| table first_seen, last_seen, src_ip, dest, http_method, request_count, distinct_endpoints, endpoints, risk, cve
| sort - request_count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   http.request.method in ("GET", "POST") and
   (
     url.path like~ "*/json-api/*" or
     url.path like~ "*/execute/*" or
     url.path like~ "*/xmlapi/*" or
     url.path like~ "*/wp-json/*"
   ) and
   (
     url.path like~ "*createacct*" or
     url.path like~ "*removeacct*" or
     url.path like~ "*passwd*" or
     url.path like~ "*addpkg*" or
     url.path like~ "*installplugin*" or
     url.path like~ "*createuser*"
   ) and
   http.response.status_code >= 200 and http.response.status_code < 400 and
   (not exists(http.request.headers.authorization) or http.request.headers.authorization == "")]

SELECT
  sourceip AS attacker_ip,
  destinationip AS target_ip,
  URL AS request_url,
  "HTTP Method" AS http_method,
  "HTTP Response Code" AS response_code,
  username,
  starttime AS event_time,
  COUNT(*) AS request_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'nginx', 'cPanel')
  AND (
    URL ILIKE '%/json-api/%' OR
    URL ILIKE '%/execute/%' OR
    URL ILIKE '%/xmlapi/%' OR
    URL ILIKE '%/wp-json/%'
  )
  AND (
    URL ILIKE '%createacct%' OR
    URL ILIKE '%removeacct%' OR
    URL ILIKE '%passwd%' OR
    URL ILIKE '%addpkg%' OR
    URL ILIKE '%installplugin%' OR
    URL ILIKE '%createuser%'
  )
  AND "HTTP Response Code" BETWEEN 200 AND 399
  AND (username IS NULL OR username = '' OR username = '-')
  AND LOGSOURCESTARTTIME(starttime, 'last 24 hours') IS NOT NULL
GROUP BY sourceip, destinationip, URL, "HTTP Method", "HTTP Response Code", username, starttime
HAVING request_count >= 1
ORDER BY event_time DESC

_sourceCategory=web/access/cpanel OR _sourceCategory=web/access/nginx OR _sourceCategory=web/access/apache OR _sourceCategory=web/access/iis
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" nodrop
| parse regex "\"(?<method>GET|POST|PUT|DELETE|PATCH)\s+(?<uri>/[^\s\"]*)" nodrop
| parse regex "\s(?<status_code>\\d{3})\s" nodrop
| parse regex "\"(?<user_agent>[^\"]+)\"\s*$" nodrop
| where uri matches "*/json-api/*" or uri matches "*/execute/*" or uri matches "*/xmlapi/*" or uri matches "*/wp-json/*"
| where uri matches "*createacct*" or uri matches "*removeacct*" or uri matches "*passwd*" or uri matches "*addpkg*" or uri matches "*installplugin*" or uri matches "*createuser*"
| where num(status_code) >= 200 and num(status_code) < 400
| count by src_ip, uri, method, status_code
| where _count >= 1
| sort by _count desc
| fields src_ip, uri, method, status_code, _count

rule cve_2026_41940_cpanel_missing_auth {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects unauthenticated exploitation of CVE-2026-41940 - WebPros cPanel & WHM and WP2 missing authentication for critical administrative functions"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /GET|POST/
    (
      $e.network.http.target_url = /\/json-api\// or
      $e.network.http.target_url = /\/execute\// or
      $e.network.http.target_url = /\/xmlapi\// or
      $e.network.http.target_url = /\/wp-json\//
    )
    (
      $e.network.http.target_url = /createacct/ or
      $e.network.http.target_url = /removeacct/ or
      $e.network.http.target_url = /passwd/ or
      $e.network.http.target_url = /addpkg/ or
      $e.network.http.target_url = /installplugin/ or
      $e.network.http.target_url = /createuser/
    )
    $e.network.http.response_code >= 200
    $e.network.http.response_code < 400
    not $e.network.http.request_headers["authorization"] != ""
    $e.principal.ip = $src_ip

  condition:
    $e
}

#event_simpleName=NetworkConnectIP4
| NetworkRemotePort in (2082, 2083, 2086, 2087, 2095, 2096, 80, 443)
| HttpPath matches regex "(?i)(/json-api/|/execute/|/xmlapi/|/wp-json/)"
| HttpPath matches regex "(?i)(createacct|removeacct|passwd|addpkg|installplugin|createuser|suspendacct)"
| HttpResponseCode >= 200 and HttpResponseCode < 400
| not HttpRequestHeaders matches regex "(?i)authorization:\s*\S+"
| groupBy([RemoteAddressIP4, LocalAddressIP4, HttpPath, HttpMethod, HttpResponseCode], function=count())
| rename(field=count, as=RequestCount)
| sort(RequestCount, order=desc)
| eval CVE="CVE-2026-41940"
| eval Tactic="Initial Access"
| eval Technique="T1190 - Exploit Public-Facing Application"