What is an XS leak or cross-site leak?

An XS leak or cross-site leak defines a class of vulnerabilities resulting from side channels implemented in web platforms.

Basic principle of XS-Leaks

The principle of XS leaks is to use such side channels available on the web to reveal sensitive information about users, such as their data in other web applications, details about their local environment or internal networks they are connected to.

How do XS leaks work?

XS leaks exploit the core principle of the web, known as composability, which enables websites to interact with each other. In doing so, cross-site leaks abuse legitimate mechanisms to derive information about a user. One way to look at XS leaks is to illustrate their similarity to the technique of Cross-Site Request Forgery (CSRF 3) . The main difference here is that XS leaks do not allow other websites to perform actions on behalf of a user, but can be used to infer information about a user. It is therefore about spying on sensitive user information. Knowledge of XS leak vulnerabilities therefore increases IT security overall.

What are the risks of cross-site attacks?

Web browsers offer a variety of functions to support interactions. All relevant data flows between different web applications, i.e. between users and an application, via such browser functions. This data, which is provided with the help of these functions, enables a website to load sub-resources, navigate or send messages to another application, for example.

Undermining the effectiveness of the same-origin policy

While such behavior is usually restricted by security mechanisms built into the web platform (e.g. the same-origin policy), XS leaks exploit small pieces of information that are disclosed during interactions between websites. This also includes metadata that is exchanged during this communication.

Indirect access to resources worthy of protection

Even though websites are not allowed to directly access data from other websites, they can load resources from them and observe the side effects. For example, evil.com is prohibited from explicitly reading a response from bank.com, but evil.com can attempt to load a script from bank.com and determine whether or not it has loaded successfully.

XS leak examples

The information used for an XS leak usually has a binary form (i.e. o and 1 or TRUE and FALSE) and is referred to as an “oracle”. A potential attacker obtains information that is definitely worth protecting or at least information that can be used directly for an attack, for example:

  • Does the word “secret” appear in the user’s data flow to another web application?

This question could be synonymous with the question:

  • Does the query ?query=secret return an HTTP 200 status code?

HTTP Status Codes & Secrets

Since it is possible to determine the HTTP 200 status code with error events, this has the same effect as the question:

  • Does loading a resource of ?query=secret in the application trigger the onload event?

The above query could be repeated by an attacker for many different keywords, so the responses could be used to infer sensitive information about the user’s data. Browsers offer a variety of different APIs that, while well-intentioned, can still reveal small amounts of cross-origin information.

Reasons and causes of XS leaks

The cause of most XS leaks lies in the design of the web, so it is essential that you have a solid knowledge of these technologies. Often applications are prone to cross-page information leaks without having done anything wrong. It is difficult to fix the cause of XS leaks at the browser level, as in many cases this would break existing websites. For this reason, browsers are now implementing various defenses to overcome these difficulties. Many of these defenses require websites and apps that access resources worthy of protection via URLS to opt for a more restrictive security model. This is usually done by using specific HTTP headers (e.g. cross-origin-opener-policy: same-origin), which often need to be combined to achieve the desired result. We can distinguish different sources of XS leaks, such as:

  • Browser APIs (e.g. frame counting and timing attacks)
  • Details and errors in the browser implementation (e.g. connection pooling and typeMustMatch)
  • Hardware errors (e.g. speculative execution attacks)

Defense strategies against XS leaks

  1. Isolation through browser settings: Security headers such as Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) make it possible to control and minimize the exchange of information between different origins.
  2. Content Security Policy (CSP): A targeted configuration of CSP can help to block unwanted content and thus prevent XS leaks.
  3. Resource restrictions: Minimize the availability of certain resources (e.g. through server-side authentication) to better protect sensitive data.

Examples of XS leaks in detail

  1. Frame counting: Attackers use differences in the number of loaded frames to draw conclusions about user activity.
  2. Timing attacks: By measuring loading times, attackers can determine whether a specific resource exists on another domain.
  3. CSS-based leaks: Style checks with CSS properties such as :visited can indirectly provide information about visited pages.

Why are XS leaks difficult to prevent?

XS leaks often occur due to basic web standards that are necessary for the interoperability of services. Changes to these standards would jeopardize numerous existing web applications. Therefore, security measures rely on the browser and specific protection configurations that must be activated by developers.

Rock the Prototype Podcast

The Rock the Prototype Podcast and the Rock the Prototype YouTube channel are the perfect place to go if you want to delve deeper into the world of web development, prototyping and technology.

🎧 Listen on Spotify: 👉 Spotify Podcast: https://bit.ly/41pm8rL

🍎 Enjoy on Apple Podcasts: 👉 https://bit.ly/4aiQf8t

In the podcast, you can expect exciting discussions and valuable insights into current trends, tools and best practices – ideal for staying on the ball and gaining fresh perspectives for your own projects. On the YouTube channel, you’ll find practical tutorials and step-by-step instructions that clearly explain technical concepts and help you get straight into implementation.

Rock the Prototype YouTube Channel

🚀 Rock the Prototype is 👉 Your format for exciting topics such as software development, prototyping, software architecture, cloud, DevOps & much more.

📺 👋 Rock the Prototype YouTube Channel 👈  👀 

✅ Software development & prototyping

✅ Learning to program

✅ Understanding software architecture

✅ Agile teamwork

✅ Test prototypes together

THINK PROTOTYPING – PROTOTYPE DESIGN – PROGRAM & GET STARTED – JOIN IN NOW!

Why is it worth checking back regularly?

Both formats complement each other perfectly: in the podcast, you can learn new things in a relaxed way and get inspiring food for thought, while on YouTube you can see what you have learned directly in action and receive valuable tips for practical application.

Whether you’re just starting out in software development or are passionate about prototyping, UX design or IT security. We offer you new technology trends that are really relevant – and with the Rock the Prototype format, you’ll always find relevant content to expand your knowledge and take your skills to the next level!