OS Command Injection Vulnerability in AUTOM8N WHM Plugin

The AUTOM8N WHM Plugin for cPanel contains a critical OS command injection vulnerability, tracked as CVE-2026-104586, which affects versions up to commit 82821f7. The vulnerability exists within the plugin's CGI scripts, specifically sync_docroots.cgi, which runs with root privileges under WHM's AppConfig. The application fails to sanitize HTTP form parameters before concatenating them into shell commands and executing them via subprocess.Popen(cmd, shell=True).

An attacker with authenticated access to the WHM interface can exploit this by appending shell metacharacters to the user parameter in an HTTP request. This enables the execution of arbitrary commands as the root user on the underlying server. Given the availability of a public proof-of-concept (PoC) exploit, the risk to hosting environments utilizing this plugin is significantly elevated, as it provides a direct path to full system compromise.

Attack Chain

1. Attacker gains authenticated access to the WHM interface of the target server.
2. Attacker identifies the sync_docroots.cgi script provided by the AUTOM8N plugin.
3. Attacker crafts an HTTP request (GET or POST) targeting sync_docroots.cgi.
4. Attacker inserts malicious shell metacharacters (e.g., ;, |, &) into the user parameter.
5. The web server passes the unsanitized parameter to the underlying CGI process.
6. The sync_docroots.cgi script executes the command string via subprocess.Popen with shell=True.
7. The operating system spawns a child process or executes the injected command with root privileges.
8. Attacker achieves remote code execution as root for exfiltration or persistence.

Impact

Successful exploitation of this vulnerability results in full administrative control over the hosting server, as the vulnerable script executes with root privileges. This allows attackers to exfiltrate sensitive data, modify websites, install persistent backdoors, or pivot deeper into the hosting network. The vulnerability impacts any infrastructure hosting cPanel/WHM environments where the AUTOM8N plugin is installed and accessible to authenticated administrative users.

Recommendation

1. Immediately restrict access to the AUTOM8N WHM plugin interface until a security patch is verified and applied.
2. Audit web server logs for suspicious HTTP requests targeting /cgi-bin/sync_docroots.cgi or similar paths containing shell metacharacters such as ;, |, &&, or backticks.
3. Deploy the Sigma rule provided below to monitor for web application exploitation attempts targeting this specific endpoint.
4. Ensure the AUTOM8N WHM plugin is updated beyond commit 82821f7 once the vendor provides a remediation patch.