Severity: moderate
CVSS 4.0: 6.3 (medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected versions:
- Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 8.0.0 through
8.19.0
- Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 9.0.0 through
9.24.0
- Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 10.0.0 through
10.11.0
Description:
Missing authorization in Apache Wicket.
org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request
handler Wicket's native WebSocket support uses to deliver an incoming frame,
resolves the shared resource named by the client's handshake parameter and
calls WebSocketResource#onPayload() on it directly, without consulting
IAuthorizationStrategy#isResourceAuthorized(). That method has a single
enforcement point in the framework,
org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the
WebSocket transport does not pass through, and WebSocketResource#respond() is
final and empty. No route to a WebSocketResource therefore asks the configured
authorization strategy whether the caller may use it, and an @AuthorizeResource
annotation on such a class has no effect.
A caller needs a bound Wicket session and the name of the resource. The name is
not a secret: Wicket writes it into the page that opens the connection. No page
of the application is otherwise involved, because a request naming a resource
is served with a throwaway page. All of the resource's callbacks are reached
this way, including onConnect() and both onMessage() overloads, and what a
callback pushes back through WebSocketRequestHandler goes to the caller's own
connection.
An application is affected where it registers a WebSocketResource as a shared
resource and relies on the authorization strategy to restrict it. What the
caller gains is whatever that resource's callbacks do with a text or binary
message of the caller's choosing. The connection is registered under the
caller's own session, so it gives no access to another user's connection.
As a workaround, reject unauthorized connections with an
IWebSocketConnectionFilter registered through
WebSocketSettings#setConnectionFilter(), or repeat the authorization check at
the start of each callback.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through
9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 7.0.0
onwards are also affected. Users are recommended to upgrade to version 8.20.0,
9.25.0 or 10.12.0, which fix the issue.
Credit:
Ugur Ozer (finder)
References:
https://wicket.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-82115
