Java : XML decoder injection

The application deserializes unvalidated XML file from an untrusted source using java.beans.XMLDecoder. This allows an attacker to execute arbitrary malicious code on the server.

JDK XMLEncoder and XMLDecoder classes provide simple methods for the permanent storage of objects by serializing them into XML documents.XMLDecoder also allows the developer to serialize method calls. If an attacker can specify XML-document that will be deserialized by the XMLDecoder class, he will be able to execute arbitrary malicious code on the server.