This paper documents deeper dive details of the security implications noted in CVE-2017-3241. Coupled with the JtaTransactionManager flaw from 2016, it demonstrates being able to achieve remote code execution.
934326ba2ee571c82aebb0cf5a71a24e7e74c20c069dcc353f0894a82feadcfb