I"P	<p>Severity: Important</p>

<p>Vendor:
The Apache Software Foundation</p>

<p>Versions Affected:
Apache Wicket 1.4.x and 1.5.x</p>

<p>Description:
It is possible to view the content of any file of a web application by
using an Url to a Wicket resource which resolves to a ‘null’ package.
With such a Url the attacker can request the content of any file by specifying
its relative path, i.e. the attacker must know the file name to be able to
request it.</p>

<p>Mitigation:
Setup a custom org.apache.wicket.markup.html.IPackageResourceGuard that provides
a whitelist of allowed resources.
Since versions 1.4.20 and 1.5.5 Apache Wicket uses by default
org.apache.wicket.markup.html.SecurePackageResourceGuard with a preconfigured
list of allowed file extensions.
Either setup SecurePackageResourceGuard with code like:</p>

<figure class="highlight"><pre><code class="language-java" data-lang="java"><span class="kd">public</span> <span class="kd">class</span> <span class="nc">MyApp</span> <span class="kd">extends</span> <span class="nc">WebApplication</span> <span class="o">{</span>
    <span class="kd">public</span> <span class="kt">void</span> <span class="nf">init</span><span class="o">()</span> <span class="o">{</span>
        <span class="kd">super</span><span class="o">.</span><span class="na">init</span><span class="o">();</span>
        <span class="nc">SecurePackageResourceGuard</span> <span class="n">guard</span> <span class="o">=</span> <span class="k">new</span> <span class="nc">SecurePackageResourceGuard</span><span class="o">();</span>
        <span class="n">guard</span><span class="o">.</span><span class="na">addPattern</span><span class="o">(...);</span>
        <span class="n">guard</span><span class="o">.</span><span class="na">addPattern</span><span class="o">(...);</span>
        <span class="n">getResourceSettings</span><span class="o">().</span><span class="na">setPackageResourceGuard</span><span class="o">(</span><span class="n">guard</span><span class="o">);</span>
    <span class="o">}</span>
<span class="o">}</span></code></pre></figure>

<p>or upgrade <a href="http://wicket.apache.org/news/2012/03/12/wicket-1.4.20-released.html">Apache Wicket 1.4.20</a> or
<a href="http://wicket.apache.org/news/2012/03/12/wicket-1.5.5-released.html">Apache Wicket 1.5.5</a></p>

<p>Credit:
This issue was discovered by Sebastian van Erk.</p>
:ET