Insufficient Session Expiration Affecting org.apache.wicket:wicket-native-websocket-core package, versions [8.0.0-M1,8.20.0)[9.0.0-M1,9.25.0)[10.0.0-M1,10.12.0)

Affected versions of this package are vulnerable to Insufficient Session Expiration via the getSession(boolean) method in the native WebSocket ServletRequestCopy component. In applications that use native WebSockets on pages or shared resources requiring authentication, an attacker with an open connection can send frames after the container expires, invalidates, logs out, or replaces the authenticated HTTP session. Because the connection continues using the copied Wicket session and its signed-in state, callbacks may authorize those frames as the revoked user, allowing access to protected functionality or actions under that user’s former privileges.

Notes

• At the session-ending step, containers that automatically close WebSocket connections when their HTTP session is destroyed eliminate the open connection needed to send further frames.
• For Wicket-managed sign-out or invalidation, the stale-session path remains for WebSocketResource; a page-bound WebSocketBehavior can no longer resolve its page after the page manager is cleared.

• Apache Security Advisory
• GitHub Commit rel/wicket-10.12.0
• GitHub Commit rel/wicket-11.0.0
• GitHub Commit rel/wicket-8.20.0
• GitHub Commit rel/wicket-9.25.0