Description
金蝶云星空管理中心的通信层默认采用的是二进制数据格式，需要进行序列化与反序列化，在此通信过程中未做签名或校验，攻击者可以通过反序列化执行任意代码，导致系统被攻击与控制
金蝶云星空存在反序列化漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/adysec/POC/blob/main/wpoc/%E9%87%91%E8%9D%B6/%E9%87%91%E8%9D%B6%E4%BA%91%E6%98%9F%E7%A9%BAUserService%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md
https://www.gksec.com/K3cloud_rce.html
https://www.cnblogs.com/ayoung/p/18551988
https://bbs.chaitin.cn/topic/540
https://cloud.tencent.com/developer/article/2316150
https://www.secrss.com/articles/55737?app=1
https://bbs.huaweicloud.com/blogs/420087
https://cn-sec.com/archives/2093295.html
https://avd.aliyun.com/detail?id=AVD-2024-1712815
https://www.lmboke.com/archives/jin-die-yun-xing-kong-fan-xu-lie-hua-yuan-cheng-dai-ma-zhi-xing-lou-dong