Untrusted Code Deserialization

rundeck is vulnerable to deserialization attack. An attacker is able to exploit the vulnerability by uploading a maliciously crafted aclpolicy yaml file to the server which will deserialise run the remote code when a user makes a POST request to it.