CORS Misconfiguration WAHS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An attacker controls a malicious website at https://evil.example. The target site https://bank.example reflects any Origin header in Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true. What can the attacker's website do to a victim who is logged into bank.example?

   • APerform actions on bank.example without the victim's browser because the attacker can directly access the server.
   • BSteal the victim's session cookie by reading it from the response headers.
   • CModify the victim's bank account balance directly without any additional steps.
   • DRead the victim's sensitive data from bank.example by making a cross-origin request with credentials.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is investigating a report that a user's profile data was stolen. The attacker's JavaScript sent a fetch request to https://api.socialapp.com/profile with credentials: 'include'. The server responded with Access-Control-Allow-Origin: https://evil.com and Access-Control-Allow-Credentials: true. The attacker's page then read the response. What is the root cause of this data exposure?

   • AThe server incorrectly allowed the Origin header value https://evil.com because it was in an allowlist
   • BThe browser sent the request with credentials because the attacker used credentials: 'include'
   • CThe API used HTTPS, which allowed the browser to bypass the Same-Origin Policy
   • DThe server reflected any Origin header value in Access-Control-Allow-Origin and allowed credentials
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A developer at a financial services company is configuring CORS for an API that serves account balances. The API is accessed by a trusted partner web app at https://partner.example.com and by the company's own app at https://app.company.com. The developer wants to allow both origins but is concerned about security. Which configuration is the most secure and correct?

   • AReflect the Origin header value in Access-Control-Allow-Origin and set Access-Control-Allow-Credentials to true
   • BSet Access-Control-Allow-Origin to * and Access-Control-Allow-Credentials to true
   • CMaintain an allowlist of the two origins and set Access-Control-Allow-Origin to the matching origin, with Access-Control-Allow-Credentials set to true
   • DSet Access-Control-Allow-Origin to https://partner.example.com only and disable credentials for the company app
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security auditor is evaluating the impact of a CORS misconfiguration in a healthcare application. The application reflects any Origin header and sets Access-Control-Allow-Credentials to true. The application also uses HTTPS and sets the Secure flag on cookies. Which statement best describes the impact?

   • AThe CORS misconfiguration is mitigated by HTTPS because the attacker cannot intercept the response.
   • BThe Secure flag prevents the CORS misconfiguration from being exploited because cookies are not sent cross-origin.
   • CThe Secure flag does not prevent the CORS misconfiguration from allowing data theft over HTTPS.
   • DThe CORS misconfiguration is only exploitable if the attacker can perform a man-in-the-middle attack.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's API is accessed by a mobile app and a web dashboard. The mobile app does not send an Origin header, while the web dashboard sends Origin: https://dashboard.example.com. The API uses cookie-based authentication. The team wants to allow both clients while preventing unauthorized cross-origin reads. What should they do?

   • AReflect any Origin header and rely on the mobile app's lack of Origin for security.
   • BConfigure the API to allow requests with no Origin header and to reflect only https://dashboard.example.com when the Origin matches that value.
   • CDisable CORS and require the web dashboard to use a server-side proxy.
   • DSet Access-Control-Allow-Origin to * and Access-Control-Allow-Credentials to true.
   Reveal Solution Discussion Select an answer first