External risk intelligence

YonBIP Arbitrary File Upload Leads to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-51928

YonBIP is an enterprise business innovation platform frequently deployed as a web-based application accessible over the network. Because this vulnerability exists within a web action method responsible for file uploads, it is typically reachable via the application's public-facing web interface in standard enterprise deployments.

Unrestricted File Upload

Yonyou Yonbip

3_23.05

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the YonBIP platform, specifically affecting its file upload functionality. This flaw could permit unauthorized parties to upload malicious files, potentially leading to the execution of arbitrary code on the system. The primary concern is to confirm if this specific version of YonBIP is in use and if it is exposed to external networks, as its nature as an enterprise platform means potential impacts could be significant.

Attackers can upload harmful files to systems.
It affects enterprise business innovation platforms.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a specially crafted file through a web interface. The system's file upload functionality, specifically the `ArcpUploadAction.doAction()` method, does not adequately validate the uploaded file. If successful, this allows an attacker to execute arbitrary code on the server, potentially leading to a complete system compromise.

No authentication or user interaction needed.
Uploading a malicious file triggers the vulnerability.
Leads to arbitrary code execution and server compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to execute arbitrary code by uploading a specially crafted file. This could impact the integrity and availability of the affected system and any data it processes.

System code execution.
Upload a crafted file.
Unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in YonBIP's file upload functionality presents a critical risk, potentially allowing attackers to execute arbitrary code. Responsibility for addressing this typically falls to application owners and platform teams, who must first pinpoint all instances of the affected technology. The immediate practical step is to confirm the scope of exposure, identify business-critical systems, and then prioritize remediation efforts based on assessed risk.

Application owners should manage remediation.
Verify reachability and business criticality.
Plan for vendor coordination or updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is YonBIP and how is it used?

YonBIP is an enterprise business innovation platform from Yonyou. It serves as a comprehensive suite for managing complex organizational workflows, digital operations, and business data. Because it acts as a central hub for business processes, it is frequently deployed as a web-based application to enable network-wide access for enterprise users.

What does CVE-2023-51928 mean for system security?

This vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434). It means the platform's file-handling logic fails to properly verify the contents or type of uploaded files. An attacker can abuse this to store malicious files directly on the server, which can subsequently be executed to compromise the system.

How is this file upload vulnerability triggered?

The flaw is triggered when a crafted file is sent to the ArcpUploadAction.doAction() method within the application. Because the vulnerability does not require any prior authentication or user interaction to reach this code, it can be initiated by any party capable of communicating with the application's file upload interface.

Is my YonBIP instance at higher risk?

Halo Surface Signal indicates that because YonBIP is typically deployed as a web-based platform, this specific upload method is often reachable via public-facing interfaces. If your instance is accessible over the internet, it is at higher risk compared to systems restricted to an internal network, as it is exposed to a broader range of potential attackers.

How should I begin addressing this CVE?

Start by identifying all deployed instances of YonBIP version 3_23.05 within your environment. Once identified, evaluate their network reachability and business criticality. Coordinate with your platform teams to prioritize these systems for remediation, and consult official vendor documentation for guidance on patches or configuration changes to secure the file upload process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.