Yonyou U8 Cloud vulnerabilities

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

A vulnerability was identified in Yonyou U8 Cloud versions 5.0, 5.0sp, 5.1, and 5.1sp, where manipulation of the usercode argument in the file nc/pubitf/erm/mobile/appservice/AppServletService.class leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available. The vendor was contacted but did not respond.

A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet in the Request Header Handler component. Manipulation of the ts/sign argument leads to unrestricted upload, and the attack may be performed remotely.