Headline
CVE-2022-29060: Fortiguard
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device.
** PSIRT Advisories**
FortiDDoS - Use of hardcoded key for the JWT token
Summary
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device.
Affected Products
FortiDDoS version 5.5.0 through 5.5.1
FortiDDoS version 5.4.0 through 5.4.2
FortiDDoS version 5.3.0 through 5.3.1
FortiDDoS version 5.2.0
FortiDDoS version 5.1.0
Solutions
Please upgrade to upcoming FortoDDoS 5.6.0 or above.
Acknowledgement
Fortinet is pleased to thank Victor Pasman for bringing this issue to our attention under responsible disclosure.