Duplicati login bypass

Duplicati is a backup tool with a web interface. Its authentication does not send the password in clear: it uses a challenge-response scheme based on a server-passphrase. The key detail is that this passphrase is stored in the configuration database (Duplicati-server.sqlite, Option table), Base64-encoded, and that the login can be replayed knowing only that value, without the original password.

The legitimate login flow is, roughly:

1. The client requests a nonce from the server (/login.cgi).
2. It computes the response by combining that nonce with the passphrase via SHA-256.
3. It sends that response; the server does the same computation and compares.

Since the stored server-passphrase is exactly the material that feeds that computation, an attacker who reads it from the database can recreate the response and authenticate. The published procedure converts the passphrase from Base64 to hex and runs, in the browser console, the same computation the client does with the nonce the server returns:

echo "<server-passphrase-base64>" | base64 -d | xxd -p -c 256

The result (the bytes in hex) is fed into the browser bypass script, which completes the challenge-response and leaves a valid session.

Why it matters so much. Duplicati often runs with high privileges (frequently root) so it can read and write any file during backups. Once inside the panel, you create a backup job whose source is a sensitive directory (for example /root) and use the restore feature to extract those files to a path your user can read. Backup and restore inherit the service's privileges: it is arbitrary read (and write) as root, that is, full compromise.

Caveat. It depends on being able to read Duplicati-server.sqlite (prior system access is needed) and on the service being reachable (it sometimes listens only on localhost, which forces a prior port forward).

How to detect it. The on-disk signature is the read of Duplicati-server.sqlite by a process that isn't Duplicati (auditd/FIM on that file), the material the passphrase comes from. In the application, the signature is a new backup job whose source is a sensitive directory (/root, /etc) followed by a restore to a path the attacker can read, something legitimate use never chains; Duplicati's logs record them. A session established from an external IP (after a port-forward) against a service that should listen on localhost is the network hint.

Defence. Do not expose the Duplicati interface; protect the configuration database; do not run the service as root unless strictly necessary; and keep it updated (recent versions harden this flow). Related to the port forward that usually precedes it.