Vulnerability Description
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://avd.aliyun.com/detail?id=AVD-2023-1686894
- https://blog.csdn.net/qq_41904294/article/details/134277353
- https://cn-sec.com/archives/2182384.html
- https://security.yonyou.com/#/noticeInfo?id=400
- https://www.vulncheck.com/advisories/yonyou-u8-cloud-java-deserialization-rce-vi
- https://www.yonyou.com/Global/
FAQ
What is CVE-2023-54398?
CVE-2023-54398 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitra...
How severe is CVE-2023-54398?
CVE-2023-54398 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-54398?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.