Two roads to remote code execution in WildFly: a pre-auth CORBA deserialization bug and a JSON parser bypass
A deep security research writeup of two independent remote code execution paths into WildFly application servers: an unauthenticated IIOP/CORBA deserialization flaw, and a jackson-databind polymorphic typing bypass in the web tier. Full technical tracing, discovery story, and working proof of…