CVE-2023-54398: Yonyou U8 Cloud RCE Vulnerability

CVE-2023-54398 Overview

CVE-2023-54398 is an unauthenticated Java deserialization vulnerability [CWE-502] in Yonyou U8 Cloud. The flaw resides in the nc.impl.pub.filesystem.FileManageServlet component. The servlet's doAction method reads raw HTTP request body data and passes it directly to ObjectInputStream.readObject() without type filtering or authentication checks. Remote attackers can send a crafted serialized payload via HTTP POST to trigger arbitrary operating system command execution. The Shadowserver Foundation first observed exploitation evidence on 2025-02-13, indicating active abuse against exposed instances.

Critical Impact

Unauthenticated remote attackers can achieve full remote code execution on Yonyou U8 Cloud servers by sending a single serialized Java object over HTTP, leading to complete system compromise.

Affected Products

• Yonyou U8 Cloud (all versions prior to the vendor-issued patch)
• Deployments exposing the FileManageServlet endpoint under nc.impl.pub.filesystem
• Internet-facing Yonyou U8 Cloud ERP installations

Discovery Timeline

• 2025-02-13 - Shadowserver Foundation first observed in-the-wild exploitation evidence
• 2026-09-15 - CVE-2023-54398 published to the National Vulnerability Database (NVD)
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2023-54398

Vulnerability Analysis

The vulnerability exists in the FileManageServlet component shipped with Yonyou U8 Cloud, an enterprise resource planning (ERP) platform widely deployed across mainland China. The servlet exposes a doAction method that accepts arbitrary HTTP POST bodies from unauthenticated clients. Instead of parsing structured input, the handler wraps the request body in an ObjectInputStream and invokes readObject(). Any serializable class present on the application classpath can therefore be instantiated during deserialization, including known gadget chains that lead to command execution.

Root Cause

The root cause is unsafe deserialization of attacker-controlled bytes without a look-ahead filter, allow-list, or JEP 290 serialization filter. The vendor also fails to enforce authentication on the servlet endpoint, so the pre-authentication attack surface includes any user who can reach the HTTP listener. The presence of common Java libraries in the U8 Cloud runtime enables gadget chain execution through ObjectInputStream.readObject().

Attack Vector

Exploitation requires only network access to the vulnerable HTTP endpoint. The attacker sends an HTTP POST request whose body contains a serialized Java payload generated by a tool such as ysoserial. When the servlet reads the request body, the gadget chain triggers execution of operating system commands under the privileges of the U8 Cloud service account. Successful exploitation yields code execution equivalent to the service process. See the VulnCheck Yonyou U8 RCE Advisory and the Aliyun AVD-2023-1686894 entry for additional technical detail.

No verified public exploit code is included here. Refer to the CN-Sec Archive Post and CSDN Security Article for community write-ups describing the request structure.

Detection Methods for CVE-2023-54398

Indicators of Compromise

• HTTP POST requests targeting URIs containing FileManageServlet or referencing nc.impl.pub.filesystem
• Request bodies beginning with the Java serialization magic bytes 0xAC 0xED 0x00 0x05
• Unexpected child processes spawned by the U8 Cloud Java process, such as cmd.exe, powershell.exe, /bin/sh, or bash
• Outbound connections from the U8 Cloud host to unfamiliar IP addresses shortly after inbound POST traffic

Detection Strategies

• Inspect web server and reverse proxy logs for POST requests to FileManageServlet from unauthenticated sources
• Enable Java Flight Recorder or agent-based instrumentation to alert on calls to ObjectInputStream.readObject() from HTTP request handlers
• Correlate process-creation telemetry showing the Java process forking shells or scripting hosts
• Deploy network signatures that match the Java serialization header combined with the vulnerable URI path

Monitoring Recommendations

• Forward web access logs and endpoint process telemetry into a centralized analytics platform for correlation
• Alert on any Yonyou U8 Cloud service account executing commands outside its baseline behavior
• Monitor egress traffic from ERP hosts for reverse shell patterns and payload staging
• Track authentication anomalies and file-system writes under the U8 Cloud install directory

How to Mitigate CVE-2023-54398

Immediate Actions Required

• Restrict network access to the U8 Cloud HTTP interface using firewall rules or a reverse proxy allow-list
• Block external HTTP POST requests to any path containing FileManageServlet at the web application firewall
• Audit servers for prior compromise indicators before applying patches, including new scheduled tasks, services, and web shells
• Rotate credentials and service account secrets stored on affected hosts once integrity is verified

Patch Information

Yonyou has published guidance through its security portal. Review the Yonyou Security Notice #400 and the Yonyou Global Security Information page for the current fixed release and upgrade procedure. Apply the vendor patch on every U8 Cloud node, including standby and disaster-recovery instances, and validate that the FileManageServlet endpoint no longer accepts serialized objects post-upgrade.

Workarounds

• Remove or disable the FileManageServlet mapping in web.xml if the component is not required for business operations
• Place the U8 Cloud application behind a WAF rule that drops requests containing the 0xAC 0xED serialization header on external interfaces
• Enforce mutual TLS or VPN-only access to the management interface until patching is complete
• Apply a JVM-wide serialization filter using -Djdk.serialFilter to deny high-risk gadget packages

# Configuration example: deny common gadget packages via JVM serialization filter
export JAVA_TOOL_OPTIONS="-Djdk.serialFilter=!org.apache.commons.collections.**;!org.apache.commons.collections4.**;!org.codehaus.groovy.runtime.**;!com.sun.rowset.**;!bsh.**;!java.rmi.**;maxdepth=10;maxrefs=1000"