Apache Wicket: Remote code execution via XSLT injection

Vulnerability

Overview The default configuration of XSLTResourceStream.java in Apache Wicket is susceptible to XSLT injection, leading to remote code execution when processing untrusted input [2][3]. This component handles XSLT transformations without proper validation, allowing an attacker to inject malicious XSLT code.

Exploitation

Conditions An attacker can provide a crafted XSLT payload to any Wicket resource that utilizes XSLTResourceStream. If the resource is publicly accessible, no authentication is required, making the attack surface broad in applications that expose such endpoints [3].

Impact

Successful exploitation enables arbitrary code execution in the context of the application server, potentially leading to full system compromise, data theft, or further lateral movement [2][3].

Mitigation

The vulnerability is fixed in Apache Wicket versions 10.1.0, 9.18.0, and 8.16.0 [2][3]. Users are strongly advised to upgrade immediately. No official workaround has been provided for unpatched versions.