The TL;DR Java Deserialization can be used to construct arbitrary Java objects, which combined with popular libraries such as Apache Commons Collections, Sprin

The TL;DR Java Deserialization can be used to construct arbitrary Java objects, which combined with popular libraries such as Apache Commons Collections, Spring or Groovy can result in arbitrary code execution on the server providing deserialization. Java app servers often provide automatic deserialization of Java objects passed as cookies, or provide protocol or admin ports (typically built on RMI or JMX) that can be used to trigger exploits. This includes Jenkins' remote CLI service; Cloudbees have provided a security vulnerability warning about this. There's no trivial way of protecting against this attack other than deleting some classes from various libraries; however, given their ubiquity in other application servers this may provide nearly impossible to do.