It can deserialise into arbitrary classes. You could deserialise a process builder to execute an arbitrary shell command [0]. [0] https://github.com/mazen160/s

It can deserialise into arbitrary classes. You could deserialise a process builder to execute an arbitrary shell command [0]. [0] https://github.com/mazen160/struts-pwn_CVE-2017-9805/blob/master/struts-pwn.py https://github.com/mazen160/struts-pwn_CVE-2017-9805/blob/ma...