CVE-2023-54398
CRITICAL · 9.8Real PoC public, verified exploitation signal, critical severity, but KEV not yet listed.
What: Unauthenticated Java deserialization RCE in Yonyou U8 Cloud FileManageServlet (CVSS 9.8 CRITICAL). Remote attackers bypass authentication to execute arbitrary OS commands via malicious serialized payloads.
Why it matters: Exploitation observed in the wild by Shadowserver Foundation on 2025-02-13. CVSS 9.8 critical severity, unauthenticated attack surface, and confirmed real-world detection signal indicate active weaponization. No KEV-listing yet, but ground-truth exploitation evidence exists.
Where it's seen: Social media aggregating vulnerability details and linking to exploit resources; chatter emphasizes critical rating and public exploit availability; Shadowserver's earlier detection validates the threat.
RISK: CRITICAL — Unauthenticated RCE, CVSS 9.8, confirmed in-the-wild exploitation observed Feb 2025.
Description
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weaknesses
References
- https://avd.aliyun.com/detail?id=AVD-2023-1686894
- https://blog.csdn.net/qq_41904294/article/details/134277353
- https://cn-sec.com/archives/2182384.html
- https://security.yonyou.com/#/noticeInfo?id=400
- https://www.vulncheck.com/advisories/yonyou-u8-cloud-java-deserialization-rce-via-filemanageservlet
- https://www.yonyou.com/Global/