CVE-2023-54398: Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Yonyou U8 Cloud deployments with the nc.impl.pub.filesystem.FileManageServlet component reachable over the network are exposed. The vulnerable endpoint can be attacked remotely without authentication.
What does an attacker need to exploit it?
An attacker only needs network access to the affected servlet and the ability to send a POST request containing a crafted serialized Java payload. No credentials or user interaction are required.
What is the likely impact of successful exploitation?
Successful exploitation allows arbitrary operating-system command execution on the affected server. The reported severity vector indicates potential high impact to confidentiality, integrity, and availability.
Has exploitation been observed in the wild?
Yes. The provided information states that the Shadowserver Foundation first observed exploitation evidence on 2025-02-13.