To sum up your link, the vulnerability is the use of an unsafe deserialization similar to:
ObjectInputStream ois = new ObjectInputStream(input);
MyObject obj = (MyObject)ois.readObject();