Missing Authorization Affecting org.apache.wicket:wicket-core package, versions [8.0.0-M1,8.20.0)[9.0.0-M1,9.25.0)[10.0.0-M1,10.12.0)

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Missing Authorization via the ListenerRequestHandler in the core request handler. An attacker can invoke a listener that the application intended to restrict by requesting a listener URL without a page identifier; Wicket generates such URLs for stateless pages, and an attacker can omit the identifier for a stateful page. On the newly constructed page, Component#configure() has not run, so canCallListener() checks constructor-default enabled and visible state rather than the RENDER authorization recorded during configuration or visibility and enablement set in onConfigure(). The page must be constructible from a bookmarkable or mounted URL using a public no-argument or PageParameters constructor, and the unauthorized listener can perform actions or change application state.

Notes

• At page construction, the target must be reachable through a bookmarkable or mounted URL and have a public no-argument or PageParameters constructor; IAuthorizationStrategy#isInstantiationAuthorized() still applies, so page-level denial blocks this route.
• At listener authorization, the bypass is limited to the component’s RENDER decision and onConfigure() state: an ENABLE denial by IAuthorizationStrategy still prevents invocation.

• Apache Security Advisory
• GitHub Commit rel/wicket-10.12.0
• GitHub Commit rel/wicket-11.0.0
• GitHub Commit rel/wicket-8.20.0
• GitHub Commit rel/wicket-9.25.0