Executive brief
Apache Wicket is a Java web framework that applications use to build interactive web pages. The ResourceIsolationRequestCycleListener component was designed to block cross-site requests (CSRF attacks), but its default policy incorrectly allowed certain legitimate-looking requests from attackers' origins. An attacker could craft a malicious web page that tricks a victim's browser into invoking sensitive actions (like form submissions or page interactions) in the victim's authenticated session without their knowledge.
Technical details
The vulnerability exists in FetchMetadataResourceIsolationPolicy, the default CSRF protection policy for ResourceIsolationRequestCycleListener introduced in Wicket 9.1.0. The policy has two unsafe allowances: (1) all GET requests with Sec-Fetch-Mode: navigate are allowed regardless of Sec-Fetch-Site header, allowing attackers to invoke component listeners (Link.onClick, form submits, behaviour callbacks) via cross-site top-level navigation—browsers send SameSite=Lax cookies on such requests; (2) requests with Sec-Fetch-Site: same-site are allowed unconditionally, permitting sibling origins to invoke listeners via any HTTP method with full cookie access. Exploitation requires no user authentication bypass but does require social engineering (user visiting attacker's page) or an existing XSS/subdomain takeover. The fix is available in Wicket 9.24.0 and 10.11.0.
Affected products
- Apache Wicket 9.1.0 through 9.23.0, 10.0.0 through 10.10.0
Timeline
- 2026-08-31: disclosed
- 2026: patched: Fixed in Wicket 9.24.0 and 10.11.0