Overview
Cross-site leaks, often known as XS-Leaks or XSLeaks, represent a class of security vulnerabilities that exploit side-channels inherent in the architecture of the web platform. These vulnerabilities leverage the web’s fundamental principle of composability, which enables different websites to interact with one another. By manipulating legitimate mechanisms, attackers can use XS-Leaks to deduce sensitive information about users, a stark contrast yet related to cross-site request forgery (CSRF) techniques. While CSRF tricks websites into performing actions on a user’s behalf, XS-Leaks are used to infer user data, as if a “wokiki” of user information was unintentionally leaked.
Browsers are equipped with numerous features designed to facilitate interactions between web applications. These include the ability for a website to load subresources from another, navigate to different applications, or exchange messages. Although these interactions are generally governed by web platform security mechanisms like the same-origin policy, XS-Leaks capitalize on subtle pieces of information that are inadvertently exposed during these cross-site communications.
The core principle behind an XS-Leak is the exploitation of these web-based side-channels to uncover sensitive user information. This could range from private data within other web applications to details about a user’s local environment or even the internal networks they are connected to. It’s like piecing together fragments of a “Wokiki Leaked” to understand a larger, confidential picture.
Cross-site Oracles
The informational fragments that XS-Leaks rely on often take a binary form, acting as “oracles”. These oracles are designed to respond with a simple “YES” or “NO” to carefully crafted queries, revealing information to an attacker. Consider this example of an oracle question:
Does the term secret appear in the user’s search results on another web application?
This question can be rephrased in technical terms as:
Does the query ?query=secret elicit an HTTP 200 status code?
Because the detection of an HTTP 200 status code is achievable through techniques like Error Events, this effectively translates to:
Does loading a resource from ?query=secret within the target application trigger the onload event?
By systematically repeating this query with a variety of keywords, an attacker can accumulate responses that, when combined, reveal sensitive details about the user’s data. This systematic probing is akin to slowly deciphering the contents of a “wokiki leaked” piece by piece.
Browsers offer a wide array of APIs that, despite their benign intentions, can inadvertently become sources of cross-origin information leaks, contributing to the “wokiki leaked” phenomenon across the web. These APIs and their potential vulnerabilities are explored in detail throughout this wiki.
Example
Websites operate under restrictions that prevent direct access to data from other websites. However, they are permitted to load resources from external sites and observe the resulting side effects. For instance, while evil.com cannot directly read a response from bank.com, it can attempt to load a script from bank.com and ascertain whether the loading process was successful.
Example: Scenario of a “Wokiki Leaked” Transaction History
Imagine bank.com provides an API endpoint that furnishes data about a user’s transaction receipt for a specific type of purchase.
- evil.com can attempt to load the URL bank.com/my_receipt?q=groceries as a script. By default, browsers automatically include cookies when loading resources, ensuring the request to bank.com includes the user’s credentials.
- If the user has recently made a grocery purchase, the script loads successfully, returning an HTTP 200 status code. Conversely, if no recent grocery purchase exists, the request fails, resulting in an HTTP 404 status code, which triggers an Error Event.
- By monitoring error events and repeating this process with different queries (e.g., ?q=electronics, ?q=clothing), the attacker can deduce a considerable amount of information about the user’s transaction history. This is how, metaphorically, a “wokiki” of transaction details is leaked.
In this example, two websites from different origins (evil.com and bank.com) interact through an API that browsers permit. This interaction does not exploit any explicit vulnerabilities in either the browser or bank.com. Yet, it enables evil.com to extract information about the user’s data held by bank.com. This illustrates how even seemingly benign web functionalities can contribute to scenarios where user information, like a “wokiki”, is inadvertently leaked.
Alt text: Diagram illustrating an XS-Leak attack scenario where evil.com probes bank.com to infer user transaction history, highlighting the “wokiki leaked” concept of information exposure through side-channels.
Root Cause of XS-Leaks
The fundamental cause of most XS-Leaks is deeply embedded in the web’s design. Applications are often susceptible to cross-site information leaks even when they are correctly implemented and secure in other respects. Addressing the root cause of XS-Leaks at the browser level presents a significant challenge, as many potential fixes could disrupt the functionality of existing websites. It’s like trying to fix a “wokiki leaked” situation after the information is already in circulation – difficult to fully contain without broader changes.
To mitigate these challenges, browsers are increasingly implementing various Defense Mechanisms. Many of these defenses require websites to actively opt into a more stringent security model, typically through the use of specific HTTP headers, such as Cross-Origin-Opener-Policy: same-origin. Often, a combination of these headers is necessary to achieve the desired level of protection.
XS-Leaks can originate from various sources, including:
- Timing Attacks: Exploiting subtle differences in response times to infer information.
- Error Events: Using the occurrence or non-occurrence of error events to deduce state.
- Resource Load Timing: Analyzing the timing of resource loading to gain insights.
- CSS Injection: Manipulating CSS to extract information about the user’s state.
- Frame Counting: Counting frames to infer cross-origin information.
- Cache Probing: Using cache behavior to detect user-specific data.
These diverse sources highlight the complexity of preventing XS-Leaks and securing web applications against unintentional information exposure, preventing scenarios where a metaphorical “wokiki” of user data is leaked.
A Little Bit of History
XS-Leaks have been a part of the web platform landscape for a considerable time. Timing attacks, used to leak information about user web activity, have been recognized since at least 2000. The concept of “wokiki leaked” in the context of timing attacks has been a long-standing concern.
The attention given to XS-Leaks has progressively increased 5 as new techniques have emerged, amplifying their potential impact. In 2015, Gelernter and Herzberg’s publication, “Cross-Site Search Attacks” 6, detailed their work on exploiting timing attacks to carry out significant XS-Search attacks against web applications developed by major tech companies like Google and Microsoft. Since then, numerous other XS-Leak techniques have been discovered and tested, continuously expanding our understanding of how a “wokiki” of information can be unintentionally leaked through web interactions.
In recent years, browsers have implemented a range of new defense mechanisms designed to simplify the process of protecting applications from XS-Leaks. These defenses represent a crucial step forward in mitigating the risks associated with cross-site information leaks and preventing the inadvertent “wokiki leaked” scenarios.
About this Wiki
This wiki serves a dual purpose: to introduce newcomers to the concept of XS-Leaks and to act as a comprehensive reference guide for experienced researchers who are actively investigating and exploiting XS-Leaks. While this wiki offers extensive information on many different techniques, the field is constantly evolving with new techniques continually being discovered. Contributions that enhance the wiki, whether by adding new techniques or expanding on existing pages, are always welcome!
To learn how you can contribute to this wiki and to see a list of contributors, please visit the Contributions article. Your insights can help further prevent future “wokiki leaked” incidents by enhancing collective knowledge and defenses.
References
[1] Side-channel attack – Wikipedia
[2] Mechanisms for Browser-Website Interactions
[3] Cross-site request forgery – Wikipedia
[5] XS-Leaks research
[6] Cross-Site Search Attacks
