Description

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-15T17:17:08.343Z",
  "pubdate": "2026-09-15T17:17:08.343Z",
  "executiveSummary": "Yonyou U8 Cloud is susceptible to a critical unauthenticated Java deserialization vulnerability located within the FileManageServlet component.\nThis vulnerability allows remote, unauthenticated attackers to achieve arbitrary OS command execution by transmitting a crafted serialized object via a POST request.\nThe flaw stems from the insecure handling of user-supplied data, specifically the invocation of ObjectInputStream.readObject() on raw HTTP request body data without prior validation or filtering.\nSuccessful exploitation grants an attacker full control over the underlying host system, leading to complete compromise of the application server.\nGiven the nature of the vulnerability, no authentication or special privileges are required, making the system highly exposed to opportunistic exploitation.\nThe Shadowserver Foundation reported active exploitation of this flaw beginning on 2025-02-13, highlighting the immediate necessity for remediation to prevent unauthorized system access and data exfiltration.",
  "technicalDetails": "The vulnerability resides in the nc.impl.pub.filesystem.FileManageServlet component of Yonyou U8 Cloud. The root cause is the improper implementation of object deserialization in the doAction method.\nWhen a POST request is sent to the vulnerable servlet, the application retrieves the raw byte stream from the HTTP request body and processes it directly using the java.io.ObjectInputStream.readObject() method.\nBecause the application does not employ an allow-list or implement class filtering during the deserialization process, an attacker can supply a malicious serialized gadget chain.\nWhen ObjectInputStream.readObject() is invoked on this payload, the JVM reconstructs the malicious objects, triggering execution of the associated gadget chain that ultimately maps to arbitrary system command invocation.\nThe attack flow follows a precise sequence: First, the attacker identifies the network-exposed FileManageServlet endpoint. Second, the attacker prepares a serialized payload using known Java deserialization gadget chains designed to facilitate RCE.\nThird, the attacker transmits this payload via a POST request to the target servlet. The server-side code receives this input as an InputStream and passes it to the vulnerable deserialization routine.\nUpon successful deserialization, the attacker’s arbitrary commands are executed with the privileges of the web server process.\nThis vulnerability allows an attacker to execute OS-level commands, facilitating post-exploitation activities such as installing persistent backdoors, moving laterally within the internal network, exfiltrating sensitive organizational data, or deploying ransomware.\nSince the FileManageServlet does not require authentication, the attack surface is wide, as any remote entity with connectivity to the application can initiate the attack sequence without prior access credentials."
}