Use of hardcoded key for the JWT token

Summary

A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device.

Affected Products

FortiDDoS 5.6 all versions are not affected
FortiDDoS 5.5 all versions
FortiDDoS version 5.4.0 through 5.4.2
FortiDDoS version 5.3.0 through 5.3.1
FortiDDoS 5.2 all versions
FortiDDoS 5.1 all versions
FortiDDoS 5.0 all versions are not affected
FortiDDoS 4.7 all versions are not affected
FortiDDoS 4.6 all versions are not affected
FortiDDoS 4.5 all versions are not affected

Solutions

Please upgrade to upcoming FortoDDoS 5.6.0 or above.

Acknowledgement

Fortinet is pleased to thank Victor Pasman for bringing this issue to our attention under responsible disclosure.

Timeline

2022-06-07: Initial publication