# De-anonymization Attack: Cross Site Information Leakage

Imgur API history endpoint and per-user subdomain return 2xx vs 4xx depending on login/ownership, enabling cross-site login detection and profile deanonymization via onload/onerror events.

- Payout: hidden
- Severity: medium
- Program: Imgur
- Found by: soheil_k
- Disclosed: 2019-12-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/723175
- Library page: https://bugbountylibrary.com/r/h1%3A723175
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium technique:recon vuln:info-disclosure vuln:xs-leak

**Target:** api.imgur.com history endpoint and <USERNAME>.imgur.com/all profile page
**Root cause:** Leaky endpoints return 2xx in one victim state and 4xx in another, so a cross-origin script tag's onload/onerror event reveals the state.
**Steps:**
1. Embed `https://api.imgur.com/3/larynx/history?IMGURPLATFORM=web&IMGURUIDJAFO=...&SESSIONCOUNT=3&client_id=546c25a59c58ad7` in a script tag; onload=logged in, onerror=logged out.
2. Embed `https://<USERNAME>.imgur.com/all` in a script tag; onload fires only if victim owns that profile.
3. Victim logged into imgur.com loads attacker page in another tab; attacker reads which event fired to infer state.
**How found:** Researchers built a tool to find xsleaks and tested imgur.com, looking for endpoints whose HTTP status differs by victim state.
**Exploitation:** Attacker page embeds the leaky resources as script tags and observes onload vs onerror to determine victim login status and profile ownership across origins.
**Escalation:** Chaining login detection with per-username subdomain probing enables cross-origin tracking/fingerprinting of users who shared images.
**Insight:** Look for authenticated API endpoints and per-user subdomains whose status code (2xx vs 4xx) varies by session or ownership; these are script-tag-embeddable XS-Leak oracles even without CORS.