CVE-2023-54398
CRITICAL · 9.8Confirmed exploitation history (Feb 2025) and public PoC references, but KEV absence and 18-month latency suggests patch availability; social chatter is amplification not discovery.
What: Unauthenticated Java deserialization in Yonyou U8 Cloud FileManageServlet allows remote code execution (CVSS 9.8 CRITICAL).
Why it matters: In-the-wild exploitation confirmed by Shadowserver Foundation on 2025-02-13; no authentication required; immediate RCE. Not yet KEV-listed but active abuse documented nearly two years before today's social surge suggests defenders have patched or are actively triaging.
Where it's seen: Social media chatter (Bluesky) surfacing today with CVSS/component details and references to public exploits; posts mention "critical with public exploit" and link to vulnerability aggregators; signals appear synchronized, suggesting routine security feed amplification.
RISK: CRITICAL — Unauthenticated RCE in production cloud service with documented in-the-wild exploitation.
Description
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weaknesses
References
- https://avd.aliyun.com/detail?id=AVD-2023-1686894
- https://blog.csdn.net/qq_41904294/article/details/134277353
- https://cn-sec.com/archives/2182384.html
- https://security.yonyou.com/#/noticeInfo?id=400
- https://www.vulncheck.com/advisories/yonyou-u8-cloud-java-deserialization-rce-via-filemanageservlet
- https://www.yonyou.com/Global/