CVE-2023-54398

Summary

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Affected Software

VendorProductVersion RangeStatus
YonyouU8 Cloud1.0affected
YonyouU8 Cloud2.0affected
YonyouU8 Cloud2.1affected
YonyouU8 Cloud2.3affected
YonyouU8 Cloud2.5affected
YonyouU8 Cloud2.6affected
YonyouU8 Cloud2.65affected
YonyouU8 Cloud2.7affected
YonyouU8 Cloud3.0affected
YonyouU8 Cloud3.1affected
YonyouU8 Cloud3.2affected
YonyouU8 Cloud3.5affected
YonyouU8 Cloud3.6affected
YonyouU8 Cloud3.6spaffected

Weaknesses

  • CWE-502: Deserialization of Untrusted Data

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: total

References