Unauthenticated RCE in Yonyou U8 Cloud via Java Deserialization

Yonyou U8 Cloud is affected by a critical Java deserialization vulnerability, tracked as CVE-2023-54398, residing within the nc.impl.pub.filesystem.FileManageServlet component. This flaw allows unauthenticated remote attackers to trigger arbitrary OS command execution by sending a crafted serialized payload in the body of an HTTP POST request. The vulnerability stems from the doAction method, which insecurely processes incoming request body data through ObjectInputStream.readObject() without implementing input validation or filtering mechanisms.

This flaw poses a severe risk to organizations, as it bypasses standard authentication controls and provides a direct pathway for full system compromise. The Shadowserver Foundation reported observing in-the-wild exploitation of this vulnerability beginning on February 13, 2025. Defenders should prioritize identifying and patching instances of Yonyou U8 Cloud to prevent unauthorized access and potential downstream impacts, such as data exfiltration or the deployment of secondary malware payloads.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Yonyou U8 Cloud instances.
2. Attacker probes for the presence of the vulnerable FileManageServlet endpoint.
3. Attacker crafts a malicious serialized Java object payload designed to execute OS commands.
4. Attacker sends an HTTP POST request containing the serialized payload to the doAction method of the target servlet.
5. The application component nc.impl.pub.filesystem.FileManageServlet fails to validate the request body.
6. The ObjectInputStream.readObject() method deserializes the untrusted payload.
7. The deserialization process executes the embedded malicious command on the underlying host OS.
8. Attacker gains remote code execution, typically used for establishing persistence or further lateral movement.

Impact

Successful exploitation of CVE-2023-54398 results in full, unauthenticated remote code execution on the underlying host running Yonyou U8 Cloud. Attackers can leverage this access to steal sensitive organizational data, manipulate financial information within the ERP, install persistent backdoors, or pivot deeper into the corporate network. Given the critical nature of ERP systems, the impact of such a compromise is high, potentially leading to widespread operational disruption and financial loss.

Recommendation

1. Patch all Yonyou U8 Cloud deployments to the version provided by the vendor that addresses CVE-2023-54398.
2. Deploy the provided webserver detection rule to identify and block incoming HTTP requests containing patterns indicative of Java object serialization.
3. Monitor webserver logs for high-frequency or anomalous POST requests directed at the FileManageServlet endpoint.
4. Restrict network access to Yonyou U8 Cloud instances to only essential internal IP ranges, removing exposure from the public internet.