Description

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation written to guard static resources, and it inherited two allowances that are unsafe when the thing being guarded is an action on a page: * Every "simple top-level navigation" was allowed. Any GET request carrying Sec-Fetch-Mode: navigate whose Sec-Fetch-Dest was neither object nor embed was allowed, whatever Sec-Fetch-Site said — including cross-site. Wicket invokes component listeners (Link.onClick(), form submits, behaviour callbacks) through ordinary GET navigations, so a page under an attacker's control could navigate the victim's browser to a listener URL and have that listener run inside the victim's authenticated session. Browsers send SameSite=Lax cookies — the effective default when no SameSite attribute is set — on cross-site top-level GET navigations, so the victim's session cookie accompanied the request. * Sec-Fetch-Site: same-site was allowed unconditionally. That value means the same registrable domain and scheme but a different origin — another subdomain or another port. Any sibling origin could therefore invoke any listener by any method, POST form submits included, and cookies are always sent on same-site requests regardless of SameSite. A hostile sibling origin obtained through a subdomain takeover, through delegated user content, or through an XSS elsewhere on the site could act as the authenticated user. Users are recommended to upgrade to version 9.24.0 or 10.11.0, which fix the issue. Affected versions * Apache Wicket 9.1.0 through 9.23.0 * Apache Wicket 10.0.0 through 10.10.0 Not affected Any release older than 9.1.0: * Apache Wicket 8.x (8.0.0 through 8.17.0). The resource isolation classes do not exist in the 8.x line, which offers only the Origin/Referer-based CsrfPreventionRequestCycleListener. No 8.x release requires a fix. * Apache Wicket 9.0.0. ResourceIsolationRequestCycleListener and FetchMetadataResourceIsolationPolicy were introduced by WICKET-6786 and first shipped in 9.1.0 (released 2020-10-07).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-31T12:17:56.803Z",
  "pubdate": "2026-08-31T12:17:56.803Z",
  "executiveSummary": "This vulnerability is a Cross-Site Request Forgery (CSRF) bypass within the ResourceIsolationRequestCycleListener component of Apache Wicket.\nThe vulnerability stems from insecure default allowances in the FetchMetadataResourceIsolationPolicy, which incorrectly permit potentially state-changing requests based on flawed trust assumptions.\nThe flaw allows unauthorized cross-site or same-site attackers to trigger sensitive actions (such as component listeners, link callbacks, or form submissions) within the context of an authenticated user's session.\nAffected products include Apache Wicket versions 9.1.0 through 9.23.0 and 10.0.0 through 10.10.0.\nThe security impact is severe, as it enables an attacker to perform unauthorized actions on behalf of a victim, effectively bypassing existing CSRF protections. Exploitation does not require advanced privileges, merely a victim with an active session to a vulnerable Wicket application.\nThe risk is high due to the ease of leveraging existing browser behavior, such as automatic cookie inclusion in same-site and top-level navigation requests, to execute arbitrary application-defined listener functions.",
  "technicalDetails": "The root cause of this vulnerability lies in the FetchMetadataResourceIsolationPolicy class, which was originally designed for static resource protection but was improperly applied to dynamic action listeners. Specifically, the policy implemented two unsafe allowances that fail to prevent CSRF attacks in the context of authenticated sessions.\nThe first vulnerability involves the unconditional allowance of 'simple top-level navigation' requests. The policy permits any GET request where Sec-Fetch-Mode is 'navigate' and Sec-Fetch-Dest is neither 'object' nor 'embed', regardless of the Sec-Fetch-Site header. Since Apache Wicket maps component listeners, form submissions, and behavior callbacks to standard GET navigations, an attacker controlling a malicious webpage can force a victim's browser to navigate to a target listener URL. Because these are cross-site top-level navigations, browsers implicitly include SameSite=Lax (or default) cookies, allowing the malicious request to execute with the full authorization of the victim's session.\nThe second vulnerability involves an overly permissive 'same-site' policy. The implementation unconditionally allows requests with Sec-Fetch-Site: same-site. This definition includes any subdomain or different port under the same registrable domain. Consequently, a hostile entity gaining control over a sibling origin—via subdomain takeover, XSS on a related application, or delegated user content—can invoke sensitive application listeners using any HTTP method, including POST. As same-site requests consistently send cookies regardless of the SameSite attribute, the attacker can successfully masquerade as the authenticated user to perform state-changing operations.\nThe exploitation flow is as follows: 1) The attacker identifies a sensitive listener URL within the Apache Wicket application. 2) The attacker baits an authenticated user into visiting a malicious site or leverages a compromised sibling domain. 3) The malicious site triggers a navigation or a request (via form or script) to the target listener URL. 4) The FetchMetadataResourceIsolationPolicy validates the request based on its flawed criteria, incorrectly categorizing the malicious request as benign. 5) The Wicket application executes the requested listener function, performing the unauthorized state change within the victim's session.\nThis issue affects the ResourceIsolationRequestCycleListener component introduced in version 9.1.0. Older versions, such as 8.x, are not affected as they rely on different, non-vulnerable CSRF prevention mechanisms."
}