Velocity remote code execution

Hello,

arbitrary shellcode can be possibly executed, using e.g java.lang.Runtime.exec(String command) on wicket site:

http://www.wicket-library.com/wicket-examples/velocity/wicket/bookmarkable/org.apache.wicket.examples.velocity.TemplatePage?3

The server should use a secure config in org/apache/velocity/runtime/defaults/velocity.properties:

runtime.introspector.uberspect=org.apache.velocity.util.introspection.SecureUberspector

regards

Sergej Michel