Deserializing Groovy objects results in arbitrary remote code execution

A specific object structure of Groovy objects can be used to run arbitrary commands remotely via unchecked deserialization. See issue COLLECTIONS-580 for a related problem in another library.

See the following links for details:

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

The payload-building code:

https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/Groovy1.java