Flag Java deserialization and unsafe Jackson typing
ObjectInputStream on untrusted data and Jackson default typing are both direct paths to RCE with a classpath gadget.
Tag: jackson
Two roads to remote code execution in WildFly: a pre-auth CORBA deserialization bug and a JSON parser bypass
A deep security research writeup of two independent remote code execution paths into WildFly application servers: an unauthenticated IIOP/CORBA deserialization flaw, and a jackson-databind polymorphic typing bypass in the web tier. Full technical tracing, discovery story, and working proof of…