Emond Papegaaij

**Name of the Vulnerable Software and Affected Versions** Apache Wicket versions 6.25.0 through 8.18.0 Apache Wicket versions 7.5.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 **Description** Improper neutralization of input during web page generation occurs when the `org.apache.wicket.markup.html.form.Button` component is attached to a `<button>` element. The constructor clears the `escape-model-strings` flag to prevent double encoding of attribute values; however, when used with a `<button>` element, the model object is written into the element body without encoding. This allows markup within the model to be rendered as active markup if the data is influenced by an attacker. This issue also affects subclasses `AjaxButton`, `AjaxFallbackButton`, and `WizardButton`. **Recommendations** Upgrade to version 8.19.0. Upgrade to version 9.24.0. Upgrade to version 10.11.0. As a temporary workaround, call `setEscapeModelStrings(true)` on any button rendering as a `<button>` element to ensure the body is escaped correctly.

**Name of the Vulnerable Software and Affected Versions** Apache Wicket versions 6.17.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 **Description** Improper neutralization of input during web page generation occurs in the `org.apache.wicket.markup.head.MetaDataHeaderItem` class, which generates `<meta>` and `<link>` header tags. The software incorrectly handles attribute values by replacing double quotes with backslashes. Since backslashes have no special meaning in HTML, a double quote can prematurely terminate an attribute, allowing subsequent data to be parsed as additional attributes of the generated tag. This issue occurs when an application provides attribute values that an attacker can influence via the `addTagAttribute` method or the `forMetaTag` and `forLinkTag` factory methods. **Recommendations** Upgrade Apache Wicket versions 6.17.0 through 8.18.0 to version 8.19.0. Upgrade Apache Wicket versions 9.0.0 through 9.23.0 to version 9.24.0. Upgrade Apache Wicket versions 10.0.0 through 10.10.0 to version 10.11.0. Avoid supplying attribute values that contain double quotes to the affected methods.

**Name of the Vulnerable Software and Affected Versions** Apache Wicket versions 1.4.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 **Description** Improper neutralization of input during web page generation occurs in the `org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions` component. While the component escapes the id and display value of options, it writes attribute names and values returned by the `getAdditionalAttributes()` function directly into the `<option>` tag without escaping. An application is susceptible if it overrides the `Palette.getAdditionalAttributesForChoices()`, `Palette.getAdditionalAttributesForSelection()`, or `AbstractOptions.getAdditionalAttributes()` functions and returns data that can be influenced by an attacker. **Recommendations** Upgrade to version 8.19.0. Upgrade to version 9.24.0. Upgrade to version 10.11.0. As a temporary workaround, escape the values within the function overrides. Restrict the use of `Palette.getAdditionalAttributesForChoices()`, `Palette.getAdditionalAttributesForSelection()`, and `AbstractOptions.getAdditionalAttributes()` to ensure they do not return attacker-influenced data.

**Name of the Vulnerable Software and Affected Versions** Apache Wicket versions 1.5.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 **Description** Improper neutralization of input during web page generation occurs in the `org.apache.wicket.markup.html.form.AbstractSingleSelectChoice` class, which serves as the base class for `DropDownChoice`. The software writes the body of the default option into the markup without escaping it, whereas other option bodies are escaped based on the `escape-model-strings` setting. The affected content is retrieved via the `getNullValidDisplayValue()` or `getNullKeyDisplayValue()` functions. An application is susceptible if it overrides these methods to return attacker-influenced data or if the null bundle entry contains such data. **Recommendations** Upgrade to version 8.19.0. Upgrade to version 9.24.0. Upgrade to version 10.11.0. As a temporary workaround, escape the value within the method override.