Home > CAPEC List > CAPEC-462: Cross-Domain Search Timing (Version 2.6)  

CAPEC-462: Cross-Domain Search Timing

 
Cross-Domain Search Timing
Definition in a New Window Definition in a New Window
Attack Pattern ID: 462
Abstraction: Detailed
Status: Draft
Completeness: Stub
+ Description

Summary

An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.

For GET requests an attacker could for instance leverage the "img" tag in conjunction with "onload() / onerror()" javascript events. For the POST requests, an attacker could leverage the "iframe" element and leverage the "onload()" event. There is nothing in the current browser security model that prevents an attacker to use these methods to time responses to the attackers' cross domain requests.

The timing for these responses leaks information. For instance, if a victim has an active session with their online e-mail account, an attacker could issue search requests in the victim's mailbox. While the attacker is not able to view the responses, based on the timings of the responses, the attacker could ask yes / no questions as to the content of victim's e-mails, who the victim e-mailed, when, etc. This is but one example; There are other scenarios where an attacker could infer potentially sensitive information from cross domain requests by timing the responses while asking the right questions that leak information.

+ Attack Prerequisites
  • Ability to issue GET / POST requests cross domain

    Java Script is enabled in the victim's browser

    The victim has an active session with the site from which the attacker would like to receive information

    The victim's site does not protect search functionality with cross site request forgery (CSRF) protection

+ Typical Severity

Medium

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Low

Some knowledge of Java Script

+ Resources Required

Ability to issue GET / POST requests cross domain

+ Solutions and Mitigations

Design: The victim's site could protect all potentially sensitive functionality (e.g. search functions) with cross site request forgery (CSRF) protection and not perform any work on behalf of forged requests

Design: The browser's security model could be fixed to not leak timing information for cross domain requests

+ References
[R.462.1] Chris Evans. "Cross-Domain Search Timing". December 11, 2009. <http://scarybeastsecurity.blogspot.com/2009/12/cross-domain-search-timing.html>.
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team

Page Last Updated: July 23, 2014