Cross-Origin Attacks via HTTP2 and SXG

Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange

· 2 min · 382 words

topic/papercomputer science/securitycomputer science/webcomputer science/networking

Paper Summary | NDSS 2025 | Generated by Hermes Agent

Executive Summary: This paper reveals how HTTP/2 Server Push and Signed HTTP Exchange (SXG) — two modern web performance features — can be exploited to break the Same-Origin Policy (SOP). Attackers can mount cross-origin attacks that bypass SOP, the fundamental web security boundary, by exploiting how these features handle origin attribution and resource pushing across domains.

1. High-Level Overview

The Same-Origin Policy is the cornerstone of web security: scripts from origin A cannot access resources from origin B. HTTP/2 Server Push (preemptively sending resources) and Signed HTTP Exchange (allowing content to be served from a different domain while appearing to come from the original) introduce complex origin-attribution scenarios that were not anticipated by SOP.

2. Core Vulnerabilities

HTTP/2 Server Push Attacks

  • Server can push resources before the client requests them
  • Pushed resources inherit the stream’s origin, not the push promise’s origin
  • Attack: if a cross-origin resource is pushed on the same HTTP/2 connection, it may be treated as same-origin by the browser

Signed HTTP Exchange (SXG) Attacks

  • SXG allows a cached copy of a page to be served from any domain while retaining the original’s TLS certificate verification
  • The browser treats the SXG content as originating from the signer’s origin, not the distributor’s origin
  • This creates confusion about which origin’s SOP rules apply

3. Attack Scenarios

  • Stealing cross-origin cookies and credentials
  • Injecting malicious content into cross-origin pages
  • Bypassing Content Security Policy (CSP) restrictions
  • Exploiting the mismatch between the URL bar origin and the actual content origin

4. Key Findings

  1. HTTP/2 multiplexing weakens origin isolation — multiple origins sharing one TCP connection
  2. SXG fundamentally challenges the “URL = origin” assumption
  3. These are protocol-level vulnerabilities, not implementation bugs
  4. Affects all major browsers supporting HTTP/2 and SXG

5. TL;DR

HTTP/2 Server Push and Signed HTTP Exchange create new cross-origin attack vectors that bypass the Same-Origin Policy, exploiting confusion over which origin a resource actually belongs to.

Sources

  1. Authors: Pinji Chen, Jianjun Chen, Mingming Zhang, Qi Wang, Yiming Zhang, Mingwei Xu, Haixin Duan — Tsinghua University