CVE-2026-3788

Executive Summary

CVE-2026-3788 is a Server-Side Request Forgery (SSRF) vulnerability in Bytedesk, an open-source customer service and ticketing platform. The flaw resides in the SpringAIOpenrouterRestService.java file, specifically within the getModels function. An attacker can manipulate the apiUrl parameter to force the server to make arbitrary HTTP requests to internal or external resources. This can lead to information disclosure, internal network scanning, or further exploitation of internal services. The vulnerability is remotely exploitable, has a public PoC, and a patch is available in version 1.4.5.4.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the Bytedesk Java application. The risk is primarily to organizations self-hosting Bytedesk. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited ability to modify data.
• Availability Impact: Low (A:L) – Limited denial of service potential.

Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit details and the potential for internal network reconnaissance elevate the risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the SpringAIOpenrouterRestService component. The getModels function accepts a user-supplied apiUrl parameter without proper validation or sanitization. When the server processes this request, it uses the provided URL to make an HTTP request to an external or internal resource.

Attack Flow:

1. An attacker sends a crafted HTTP request to the Bytedesk server, targeting the vulnerable endpoint.
2. The request includes a manipulated apiUrl parameter, e.g., http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint) or http://localhost:8080/admin.
3. The server, acting as a proxy, makes a request to the attacker-specified URL.
4. The response from the internal resource is returned to the attacker, potentially leaking sensitive data.

Root Cause: Lack of input validation on the apiUrl parameter. The code does not restrict the protocol, host, or port, allowing arbitrary HTTP requests.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.4.5.4):

// source-code/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java
public String getModels(String apiUrl) {
    // Directly uses the user-supplied apiUrl without validation
    RestTemplate restTemplate = new RestTemplate();
    String response = restTemplate.getForObject(apiUrl, String.class);
    return response;
}

Patched Code (commit 975e39e4dd527596987559f56c5f9f973f64eff7):

// Patched version
public String getModels(String apiUrl) {
    // Validate the URL against an allowlist
    if (!isValidUrl(apiUrl)) {
        throw new IllegalArgumentException("Invalid API URL");
    }
    RestTemplate restTemplate = new RestTemplate();
    String response = restTemplate.getForObject(apiUrl, String.class);
    return response;
}

private boolean isValidUrl(String url) {
    // Example validation: only allow specific domains
    try {
        URI uri = new URI(url);
        String host = uri.getHost();
        return host != null && (host.equals("api.openrouter.ai") || host.equals("api.bytedesk.com"));
    } catch (Exception e) {
        return false;
    }
}

The patch introduces a URL validation function that restricts the allowed hosts to a predefined allowlist, preventing SSRF attacks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Bytedesk instance (version < 1.4.5.4).
• Network access to the Bytedesk server.

Exploitation Steps:

1. Identify the vulnerable endpoint. Based on the code, it is likely exposed via a REST API path like /api/ai/models.
2. Craft a request with a malicious apiUrl parameter.
3. Use a tool like curl or Burp Suite to send the request.

Example Exploit (curl):

# Attempt to access AWS metadata endpoint
curl -X GET "http://target.bytedesk.com/api/ai/models?apiUrl=http://169.254.169.254/latest/meta-data/"

# Attempt to access internal service
curl -X GET "http://target.bytedesk.com/api/ai/models?apiUrl=http://localhost:8080/admin"

Expected Outcome: The server will return the contents of the internal resource, leaking sensitive information.

Blue Team

Detection & Response:

• Monitor for unusual outbound HTTP requests from the Bytedesk server to internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).
• Alert on requests to the /api/ai/models endpoint with suspicious apiUrl parameters.
• Implement network segmentation to limit the impact of SSRF.

Mitigation Steps:

1. Immediately upgrade to Bytedesk version 1.4.5.4 or apply the patch commit.
2. If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block requests with apiUrl parameters containing internal IP addresses or non-standard hosts.
3. Restrict outbound traffic from the Bytedesk server using egress firewalls.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Bytedesk server to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254).
  • Requests to the /api/ai/models endpoint with a non-standard apiUrl parameter.
• Log IOCs:
  • Web server logs showing GET /api/ai/models?apiUrl=http://... with unusual hosts.
  • Application logs containing errors related to URL parsing or connection failures to internal hosts.
• File IOCs:
  • Modified SpringAIOpenrouterRestService.java file (if attacker has code access).

Detection Engineering

YARA Rule

rule CVE_2026_3788_SSRF_Bytedesk {
    meta:
        description = "Detects SSRF exploitation attempts against Bytedesk CVE-2026-3788"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-3788"
    strings:
        $s1 = "apiUrl=" ascii wide nocase
        $s2 = "169.254.169.254" ascii wide nocase
        $s3 = "localhost" ascii wide nocase
        $s4 = "10." ascii wide nocase
        $s5 = "172.16." ascii wide nocase
        $s6 = "192.168." ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: Bytedesk SSRF Exploitation Attempt (CVE-2026-3788)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit SSRF in Bytedesk by manipulating the apiUrl parameter.
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'apiUrl='
        cs-uri-query|contains|any:
            - '169.254.169.254'
            - 'localhost'
            - '10.'
            - '172.16.'
            - '192.168.'
    condition: selection
falsepositives:
    - Legitimate use of internal APIs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-3788 Bytedesk SSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"/api/ai/models"; http_uri; content:"apiUrl="; http_uri; pcre:"/apiUrl=http:\/\/(169\.254\.169\.254|localhost|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Bytedesk to version 1.4.5.4 or apply the commit 975e39e4dd527596987559f56c5f9f973f64eff7.
2. WAF Rule: Block requests to /api/ai/models with apiUrl parameters containing internal IP addresses or non-allowlisted hosts.
3. Network Segmentation: Ensure the Bytedesk server cannot access sensitive internal resources (e.g., cloud metadata endpoints, internal admin panels).

Long-Term Measures:

• Implement input validation for all user-supplied URLs.
• Use an allowlist approach for external API calls.
• Conduct regular security audits and penetration testing.
• Monitor for similar SSRF vulnerabilities in other components.

Valters IT – Securing your digital frontier.