CVE-2021-23937: DNS-based Denial of Service in Apache Wicket
Summary
CVE-2021-23937: DNS based denial of service in Apache Wicket. Affects org.apache.wicket:wicket-core across 3 version ranges.
< 7.18.0
>= 8.0.0, < 8.12.0
>= 9.0.0, < 9.3.0
Fixed in 7.18.0, 8.12.0 or 9.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Wicket is an open-source Java web application framework that simplifies the development of dynamic web applications. It provides a component-based programming model and a rich set of reusable UI components. Apache Wicket is widely used in enterprise applications to build robust and scalable web interfaces. However, a vulnerability has been discovered in Apache Wicket that allows for a DNS-based denial of service attack.
Vulnerability Detail
The vulnerability exists in the WebClientInfo component of Apache Wicket. When the X-Forwarded-For header is not properly sanitized, an attacker can trigger arbitrary DNS lookups from the server. This can be exploited to overload an internal DNS server or slow down request processing, leading to a denial of service on either the internal infrastructure or the web application itself. The vulnerability affects Apache Wicket versions 6.x, 7.x, 8.x, and 9.x.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.18.07.18.0 -
>= 8.0.0, < 8.12.08.12.0 -
>= 9.0.0, < 9.3.09.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above.
Conclusion
The DNS-based denial of service vulnerability in Apache Wicket can be mitigated by upgrading to the latest patched version and properly sanitizing the X-Forwarded-For header. It is important to stay updated with security patches and follow best practices to ensure the security of your web applications. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.wicket:wicket-core →
FAQ
Apache Wicket is an open-source Java web application framework used for building dynamic web applications.
This vulnerability allows an attacker to trigger arbitrary DNS lookups, potentially leading to a denial of service on the internal infrastructure or the web application.
The vulnerability affects Apache Wicket versions 6.x, 7.x, 8.x, and 9.x.
Yes, it is recommended to upgrade to the latest patched version of Apache Wicket as mentioned in the 'how_to_fix' section.
There is no known workaround for this vulnerability. Applying the fix is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.wicket:wicket-core.
