[WICKET-6037] ModalWindow vulnerable to Javascript injection through title model

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.5.11, 7.1.0
• Fix Version/s: 7.2.0, 8.0.0-M1, 6.22.0, 1.5.15
• Component/s: wicket-extensions
• Assignee: Sven Meier
• Reporter: Tobias Gierke
• Created: 18/Nov/15 11:22
• Updated: 19/Nov/15 09:14
• Resolved: 19/Nov/15 09:14

Description

I came across this while fixing XSS vulnerabilities found during a penetration test of our application (which sadly still uses Wicket 1.5.x).

Just to be sure, I also checked the source from Wicket 7.1.0 and the issue is present as well.

The following lines in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow#getWindowOpenJavaScript() are the culprit
------------------
Object title = getTitle() != null ? getTitle().getObject() : null;
if (title != null)

{ appendAssignment(buffer, "settings.title", escapeQuotes(title.toString())); }

-----------------

Using escapeQuotes() is not enough since Javascript written without quotes is still executed by at least the latest Firefox version (didn't bother checking other browsers).

For example having the title model return a string that contains

<i onclick=alert(1)>stuff</i>

will make the browser show a JS popup when clicking on the dialog title.