Java Deserialization Hidden Behind a JSON API
A JSON dashboard-import API hid a Java deserialization RCE: a Base64+DEFLATE blob deserialized by a background worker, past a WAF and a serialization filter guarding the wrong service. Confirmed with URLDNS, then escalated to remote code execution.