CVE-2023-54398

Yonyou U8 Cloud contains a critical unauthenticated Java deserialization flaw (CVSS 4.0: 9.3) in the nc.impl.pub.filesystem.FileManageServlet component. The doAction method passes the raw HTTP request body directly to ObjectInputStream.readObject() without any filtering or authentication, so a remote attacker can achieve arbitrary OS command execution simply by POSTing a crafted serialized Java payload to the vulnerable servlet. Successful exploitation gives the attacker full control of the underlying server with the privileges of the application, typically enabling ransomware deployment, data theft, or use as a foothold for lateral movement. Any organization running Yonyou U8 Cloud (a widely deployed ERP platform, primarily in Chinese enterprises) with the FileManageServlet endpoint reachable is affected; specific vulnerable version ranges were not stated in the advisory data. Exploitation of this vulnerability has been observed in the wild, with the Shadowserver Foundation first recording exploitation attempts on 2025-02-13.

What to do: Apply Yonyou's official patch for U8 Cloud as soon as possible and confirm the fixed version with the vendor, since no fixed version number was published in the advisory. Immediately restrict network access to the FileManageServlet endpoint (and the U8 Cloud application generally) so it is not reachable from the unauthenticated internet, and consider WAF/IPS rules that block serialized Java object payloads to these paths. Review logs around nc.impl.pub.filesystem.FileManageServlet POST activity for anomalous requests and any signs of command execution, since active exploitation has been observed since at least February 2025.