CORS Misconfiguration WAHS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security engineer is reviewing a CORS misconfiguration in a banking application. The API reflects any Origin header and sets Access-Control-Allow-Credentials to true. The application also uses a CSRF token in a custom header for state-changing requests. Which statement best describes the additional risk posed by the CORS misconfiguration beyond standard CSRF defenses?

   • AThe CSRF token does not protect against reading sensitive data, which the CORS misconfiguration enables.
   • BThe CORS misconfiguration allows the attacker to bypass the CSRF token by sending requests without it.
   • CThe CORS misconfiguration is mitigated by the CSRF token, so there is no additional risk.
   • DThe CSRF token is sent as a cookie, so the attacker can read it via the CORS response.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security review found that a web application's API responds to requests with Origin: null by setting Access-Control-Allow-Origin: null and Access-Control-Allow-Credentials: true. Which attack scenario is most directly enabled by this misconfiguration?

   • AA DNS rebinding attack that changes the origin of the malicious site.
   • BA sandboxed iframe from a malicious site can make a credentialed request and read the response.
   • CA man-in-the-middle attack that injects the null origin header.
   • DA cross-site request forgery (CSRF) attack that submits a form to the API.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A penetration tester is evaluating a CORS misconfiguration on an API that reflects any Origin and allows credentials. The API also requires a CSRF token in a custom header for state-changing requests. The tester wants to read the victim's data via a GET request. Which statement is true?

   • AThe tester must first obtain a CSRF token via a preflight request
   • BThe tester can read the victim's data with a simple GET request because CORS allows it and the CSRF token is not required for GET
   • CThe CSRF token prevents the tester from reading data because it is required for all requests
   • DThe tester cannot read the data because the custom header triggers a preflight that the server rejects
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A developer is implementing CORS for an API that is accessed by a mobile app and a web application. The web application is served from https://app.example.com. The developer wants to allow the mobile app (which does not send an Origin header) and the web app. Which configuration is correct?

   • ASet Access-Control-Allow-Origin to * and require the mobile app to send a custom header.
   • BAllow requests with no Origin header and reflect only https://app.example.com when the Origin matches.
   • CDisable CORS and require the web app to use a server-side proxy.
   • DReflect any Origin header and rely on the mobile app's lack of Origin for security.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is assessing the impact of a CORS misconfiguration on an internal HR portal. The portal uses cookie-based authentication and is accessible only from the corporate network. An attacker cannot directly access the portal, but can host a public website. Which statement best describes the risk?

   • ARisk is limited to CSRF-like actions, but the attacker cannot read responses
   • BNo risk, because the portal is internal and the attacker cannot reach it
   • CThe attacker can read the victim's HR data if the victim visits the malicious site while on the corporate network and the CORS configuration allows the attacker's origin
   • DThe attacker can directly access the portal by spoofing the Origin header
   Reveal Solution Discussion Select an answer first