Example of a vulnerable RMI object

UnsafeRmiObject.java

public class Server {
  
    public void bindRemoteObject(Registry registry) throws Exception {
        registry.bind("unsafe", UnicastRemoteObject.exportObject(new RemoteObjectImpl()));
    }
}

interface RemoteObject extends Remote {
    // this remote method is vulnerable because it accepts a complex parameter
    void action(Object obj) throws RemoteException;
}

class RemoteObjectImpl implements RemoteObject {
    // ...
}