CyberRota Analysis
AI-GeneratedThe vulnerability affects the Yonyou U8 Cloud's Java component, specifically the FileManageServlet, which allows remote unauthenticated attackers to execute arbitrary operating system commands through a crafted serialized payload sent via POST request. This critical flaw, with a CVSS score of 9.8, poses a significant risk of remote code execution due to the lack of input validation in the doAction method. Organizations utilizing Yonyou U8 Cloud should prioritize immediate remediation to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.