Youkefu Deserialization Vulnerability in TemplateController

A deserialization vulnerability has been identified in Youkefu versions up to 4.2.0. The issue resides in the TemplateController.java file, specifically within the impsave function. The vulnerability is triggered by manipulating the dataFile parameter, leading to unsafe deserialization of data. This issue can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for unsafe deserialization, which could be leveraged to execute arbitrary code or cause other malicious effects, depending on the application's context and the deserialization payload used.

Reproduction

To reproduce this vulnerability, send a request to the /admin/template/imsave endpoint with a crafted dataFile parameter that exploits the deserialization flaw. The ysoserial tool can be used to generate a payload that takes advantage of this vulnerability, such as one that uses the URLDNS gadget to exfiltrate data.