Session Fixation Affecting org.apache.wicket:wicket-auth-roles package, versions [8.18.0, 8.20.0)[9.23.0, 9.25.0)[10.9.0, 10.12.0)

Affected versions of this package are vulnerable to Session Fixation via the signIn(String, String) method in AuthenticatedWebSession in the role-based authentication module. An attacker can retain access to a victim’s authenticated session by signing in to obtain a session ID, placing that already-authenticated session ID in the victim’s browser, and having the victim successfully authenticate again while already signed in; the method does not renew the ID on repeat authentication, leaving the attacker’s known ID usable for the victim’s authenticated session. This requires the application to allow re-authentication through AuthenticatedWebSession and does not apply when the application renews the session ID after every successful authentication.

Notes

• To plant the ID, the attacker needs a way to set the servlet-container-managed JSESSIONID, such as control of a host under the same registrable domain or a deployment that carries session IDs in URLs.
• The planted ID must belong to a session the attacker has already signed in to; the victim’s first successful sign-in renews an unsigned session’s ID.

Workarounds

• In the application’s authenticate(String, String) implementation, call Session#changeSessionId() after every successful authentication to prevent a previously known session ID from remaining valid for the authenticated session.

• Apache Security Advisory
• GitHub Commit rel/wicket-10.12.0
• GitHub Commit rel/wicket-11.0.0
• GitHub Commit rel/wicket-8.20.0
• GitHub Commit rel/wicket-9.25.0