#!/bin/bash
# Afrihost - cpanel auth vulnerability disclosure check

# cpanel check
if ! [ -f "/usr/local/cpanel/cpanel" ]; then
       echo "Not_cpanel"
       exit
fi



if /usr/local/afribin/configs/cpanel_check_access_vul  | egrep -q 'unknown|StillVul'; then 
echo -e  "\n$(grep HOST /etc/wwwacct.conf)" 
echo -e "Status: \e[31mCVE-2026-41940 (cpanel_auth_bypass) vulnerable\e[0m"
echo -e "Status: \e[31mRestrictions are active and need to remain this way until server secured.\e[0m"
echo -e "==- Cpanel service ports for cpanel/webmail/whm need to remain restricted due to cpanel software vulnerability"
echo -e "==- @support - To allow client IPs to connect to restricted cpanel ports, this can be added by running:"
echo -e "==- /usr/local/afribin/configs/cpanel_allow_IP_cpanel_ports <public_ip_address>"
/usr/local/cpanel/cpanel -V
echo -e "=SAFE_MIN_VERSIONS=
$(cat /usr/local/afribin/configs/cpanel_safe_versions.txt)"
echo -e  "\n$(grep HOST /etc/wwwacct.conf)"
if !  iptables-save | grep 2087 | grep -q  DROP ; then 
/usr/local/afribin/configs/cpanel_firewall_locksdown_cpanel_ports
echo "= fw_check ="
telegram-send --config /root//.config/telegram-send.crit.conf "$(grep HOST /etc/wwwacct.conf) -cpanel_auth_update_check - unpatched" > /dev/null 2>&1
fi
exit 
fi

# if not vul but still blocking
if  /usr/local/afribin/configs/cpanel_check_access_vul | grep -q cpanel_safe && iptables-save | grep 2087 | grep -q  DROP  ; then
echo -e  "\n$(grep HOST /etc/wwwacct.conf)" 
printf "Status: \e[32m%s\e[0m\n" "Server Patched CVE-2026-41940 (cpanel_auth_bypass)"
echo -e "==- Restrictions being removed, ask client to re-test"
cat /dev/null > /etc/afrihost_custom_iptable_rules.sh 
/usr/local/afribin/configs/named_set_local_only_firewall --block  > /dev/null 2>&1
/usr/local/afribin/maintenance/firewall install    > /dev/null 2>&1 
/usr/local/cpanel/cpanel -V  
else 
echo -e  "\n$(grep HOST /etc/wwwacct.conf)" 
printf "Status: \e[32m%s\e[0m\n" "Server Patched CVE-2026-41940 (cpanel_auth_bypass)"
echo -e "==- No restrictions active on the server"
if ! iptables-save |grep -q fh_level4 ; then 
cat /dev/null > /etc/afrihost_custom_iptable_rules.sh 
/usr/local/afribin/configs/named_set_local_only_firewall --block > /dev/null 2>&1 
/usr/local/afribin/maintenance/firewall install > /dev/null 2>&1
echo -e "if client still experiencing issue send Paulo a message with server and clients IP, please"
fi
/usr/local/cpanel/cpanel -V
fi
echo -e "=SAFE_MIN_VERSIONS=
$(cat /usr/local/afribin/configs/cpanel_safe_versions.txt)"
echo -e  "\n$(grep HOST /etc/wwwacct.conf)"