Bytedesk Server-Side Request Forgery Vulnerability in Gitee API Endpoint

A server-side request forgery (SSRF) vulnerability has been identified in Bytedesk versions through 1.3.9. The issue arises in the SpringAIGiteeRestController component, specifically within the getModels function of the SpringAIGiteeRestService.java file. The vulnerability allows remote exploitation by manipulating the apiUrl parameter, which is passed to RestTemplate.exchange() without proper validation. This flaw could be exploited to probe internal networks, access cloud metadata services, and potentially exfiltrate credentials.

Impact

Exploitation of this vulnerability allows for server-side request forgery, with confirmed DNS callbacks indicating that the requests originated from the vulnerable server. This could be used to probe internal networks, access cloud instance metadata services, and exfiltrate credentials, according to the vulnerability submitter.

Reproduction

To reproduce this vulnerability, send a GET request to the /gitee/api/v1/models endpoint with a crafted apiUrl parameter. The server will process the request and make an HTTP request to the URL specified in the apiUrl parameter, bypassing any URL validation. This can be done using a tool like curl or Postman, or by exploiting the vulnerability through a script that automates the process.

Remediation

Upgrade to Bytedesk version 1.4.5.4, which addresses this vulnerability. The patched version is available on the Bytedesk GitHub Releases page.