CVE-2026-82956 Cross-site scripting (XSS) en AjaxNewWindowNotifyingBehavior de Apache Wicket
Neutralización incorrecta de entrada durante la generación de páginas web en Apache Wicket. AjaxNewWindowNotifyingBehavior toma el valor de window.name enviado por el cliente como parámetro windowName, lo almacena en el estado serializado de la página y lo inserta en un literal JavaScript entre comillas simples al construir la precondición de su llamada Ajax, que Wicket emite como JavaScript sin comillas. Esto permite XSS.
CVSS 4.0
- Probabilidad de explotación · EPSS del 09/110,3 % · percentil 23
- Explotada activamenteNo confirmada
- Exploit públicoNo conocido
Afectados
Apache Software Foundation Apache Wicket
desde 8.0.0 hasta 8.19.0desde 9.0.0 hasta 9.24.0desde 10.0.0 hasta 10.11.0
Qué hacer
- Verificá si usás Apache Wicket y en qué versión.
- Actualizá a la versión corregida que indique el fabricante en su aviso o aplicá su mitigación.
- Revisá registros y accesos de los sistemas expuestos para descartar un uso previo.
Calculadora CVSS
CVSS 4.0 · 7.6 ALTA
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Vector de ataqueRed
- Complejidad del ataqueBaja
- Requisitos del ataquePresentes
- Privilegios requeridosNinguno
- Interacción del usuarioPasiva
- Confidencialidad (sistema vulnerable)Alta
- Integridad (sistema vulnerable)Alta
- Disponibilidad (sistema vulnerable)Ninguna
- Confidencialidad (sistemas posteriores)Ninguna
- Integridad (sistemas posteriores)Ninguna
- Disponibilidad (sistemas posteriores)Ninguna
Descripción original
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.name, which reaches the server as the request parameter windowName, and remembers what the browser reported in a field of the behaviour. That field is part of the page's serialized state, so the remembered value stays in the page store for as long as the page instance does.
On every later render of that page instance the behaviour builds the precondition of its Ajax call by substituting the remembered value into a single-quoted JavaScript string literal, and Wicket writes that precondition into the page as raw JavaScript, because the precondition of an Ajax call listener is script supplied by the caller and is emitted without quoting or escaping. Nothing on that path escapes the value. The window name is client-supplied and Wicket applies no validation to it, so a remembered name containing a single quote ends the literal and the rest of it runs as script in the application's origin, every time that page instance is rendered.
An application is affected only where it has explicitly added AjaxNewWindowNotifyingBehavior to a component. No part of the framework installs the behaviour, so an application that does not use it is not affected. The name the behaviour generates for itself, when the browser reports no name at all, is a random UUID and is not client-supplied.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0.
Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.
Referencias (1)
Resumen traducido automáticamente de la descripción original. Fuente: Nureq Monitor. Cómo funciona.