HTB CWEE Practice Questions - HTB Certified Web Exploitation Expert Exam

Access More Questions

A web application merges user-supplied JSON into a configuration object using a recursive deep-merge function. An attacker sends {"__proto__":{"isAdmin":true}}. What is the primary risk?

All subsequently created objects inherit isAdmin:true, enabling privilege escalation The server crashes due to circular reference detection The JSON parser rejects the __proto__ key as invalid syntax Only the merged object is affected; other objects remain unmodified

Correct Answer:

All subsequently created objects inherit isAdmin:true, enabling privilege escalation

Access more questions from this quiz

Continue to HTB CWEE Practice Questions - HTB Certified Web Exploitation Expert Exam for more practice questions and the full quiz experience.

Access More Questions