CORS Misconfiguration WAHS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has an API that supports both a public mobile app and a web dashboard. The mobile app does not use cookies; it uses an API key in a custom header. The web dashboard uses cookies. The current CORS configuration reflects any Origin and sets Access-Control-Allow-Credentials: true. The company wants to fix the vulnerability without breaking the mobile app. What is the best approach?

   • AUse an allowlist for the web dashboard's origin and keep credentials enabled; for the mobile app, do not rely on CORS since it is not browser-based
   • BRemove Access-Control-Allow-Credentials and keep the wildcard origin
   • CDisable CORS entirely and require all requests to use the API key header
   • DSet Access-Control-Allow-Origin to * and Access-Control-Allow-Credentials to true only for requests from the mobile app
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is investigating a report that a user's profile data was stolen from a web application. The application reflects any Origin header in Access-Control-Allow-Origin and sets Access-Control-Allow-Credentials to true. The user was logged in and visited a malicious site. How did the attacker most likely steal the data?

   • AThe attacker's site made a cross-origin fetch to the application with the user's cookies, and the application allowed the response to be read due to the reflected origin.
   • BThe attacker guessed the user's session token and used it directly against the API.
   • CThe attacker performed DNS rebinding to make the malicious site appear as the application's origin.
   • DThe attacker used a cross-site scripting (XSS) vulnerability to inject JavaScript into the application's own pages.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A developer wants to securely allow a single trusted partner domain to access an API. Which CORS configuration is the most appropriate?

   • AValidate the Origin header against a whitelist and, if it matches, echo the origin in Access-Control-Allow-Origin.
   • BSet Access-Control-Allow-Origin to * because the API is public.
   • CSet Access-Control-Allow-Origin to the partner domain without any validation.
   • DDisable CORS entirely by not sending any Access-Control-Allow-Origin header.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A developer configures the server to reflect any Origin header value in the Access-Control-Allow-Origin response header. Which CORS misconfiguration pattern does this represent?

   • AOverly permissive Access-Control-Allow-Origin with a wildcard
   • BReflecting arbitrary origins
   • CMissing Access-Control-Allow-Credentials header
   • DUsing a null origin
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is performing a risk assessment of a web application that uses cookie-based authentication. They find that the API reflects any Origin header and sets Access-Control-Allow-Credentials to true. Which impact best describes the risk to the application?

   • AAn attacker can read sensitive data from authenticated users by luring them to a malicious website.
   • BAn attacker can perform CSRF attacks to change user data, but cannot read the response.
   • CAn attacker can take over user accounts by stealing session cookies via the CORS headers.
   • DAn attacker can perform a denial-of-service attack by sending many cross-origin requests.
   Reveal Solution Discussion Select an answer first