Duplicati 2.2.0.3 – JWT Signing Key Leak Enables Admin Token Forgery
What Happened – A case‑sensitive guard bypass in Duplicati 2.2.0.3’s /api/v1/serversetting/JWTConfig endpoint allows any authenticated user to retrieve the JWT SigningKey, Authority, and Audience. With those values an attacker can forge a long‑lived admin token that grants full administrative control over the backup platform.
Why It Matters for Compliance & Audit Readiness
- The flaw bypasses logical‑access controls that SOC 2 expects to be enforced for privileged operations.
- Continuous‑compliance programs must evidence proper secret management and token‑lifecycle monitoring; this incident shows a gap that can be captured as audit evidence.
- Verisq’s SOC 2 Access Controls capability helps you map JWT‑key handling to CC6.1 (Logical Access) and provides continuous monitoring to prove remediation.
Who Is Affected – SaaS backup providers, managed service providers, and any organization that runs Duplicati for internal or customer data protection (technology, finance, healthcare, etc.).
Recommended Actions
- Upgrade to Duplicati 2.2.0.4 or later where the guard bypass is patched.
- Rotate all JWT signing keys immediately and enforce short token lifetimes.
- Add automated checks that verify secret exposure is not possible via API endpoints; map to SOC 2 CC6.1 controls and collect evidence for audit readiness.
Technical Notes – The exploit leverages a case‑sensitive routing bug (guard check only applied to “jwt‑config” but not “JWTConfig”). No CVE assigned yet (pending). A forged token can be set to expire in 10 years, effectively providing perpetual admin access. Source: Exploit‑DB 52646