HackDonalds Challenge Writeup

By /

Table of Contents

Description:

The challenge was solved by chaining an authentication bypass with an XXE vulnerability. By adding the HTTP header X-Middleware-Subrequest: middleware, the application mistakenly granted access to restricted admin functionality without proper authentication. This allowed interaction with sensitive internal features that would normally require admin privileges. Using this access, an XML External Entity (XXE) payload was submitted to an XML-processing endpoint. The XXE payload was crafted to read the file package.json from the application’s current working directory via the symbolic path /proc/self/cwd/package.json. This file contained the challenge flag, confirming that both the authentication bypass and XXE were successfully exploited.

POC:

  1. I have bypass the login with this header X-Middleware-Subrequest: middleware directly access into admin

2. Click on Ice Cream Machines then click on view settings

3. i have used this payload in the XML Configuration Settings

4. Finally grab the flag

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///proc/self/cwd/package.json">
]>
<stockCheck><productId>&xxe;</productId></stockCheck>

Flag :

INTIGRITI{XXE_Redacted_M4ch1n3s}

Reference :

  1. https://app.intigriti.com/researcher/programs/intigriti/challenge-hackdonalds/detail
  2. https://nagasaikiran.com/middleware-mishap-a-deep-dive-into-next-js-cve-2025-29927/

25 thoughts on “HackDonalds Challenge Writeup”

  16. binance

    I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.

    Reply
  19. p898

    Alright, check out p898. Quick and straight to the point. If you’re looking for easy access, this might be your thing. Pretty interesting to be sure. See for yourself here: p898

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top