Cross-Site Leak

web security

Definition

Cross-Site Leak (XS-Leak)

An XS-Leak is a side-channel technique that lets an attacker on evil.com infer information about a victim’s interaction with another site (e.g. bank.com) without violating the Same-Origin Policy. The SOP still denies direct access, but the attacker can build a boolean oracle out of subtleties in the web platform — whether a URL returns 200 or 404, how long it takes, how many frames it opens, whether an error fires — and exfiltrate data bit by bit.

XS-Search

XS-Search

The most dangerous form is XS-Search: a series of oracle queries (one per guess) over a search endpoint reveals whether a given query has results, which is enough to read out private content such as the presence of a specific credit-card number in a mailbox. Each query yields one bit, exactly as in totally blind SQLi but now over the SOP boundary.

Defending against XS-Leaks is difficult because the oracles are numerous and platform-defined; SameSite cookies close some vectors but not all. The reference catalogue is xsleaks.dev.