HackDonalds Challenge Writeup

By /

Table of Contents

Description:

The challenge was solved by chaining an authentication bypass with an XXE vulnerability. By adding the HTTP header X-Middleware-Subrequest: middleware, the application mistakenly granted access to restricted admin functionality without proper authentication. This allowed interaction with sensitive internal features that would normally require admin privileges. Using this access, an XML External Entity (XXE) payload was submitted to an XML-processing endpoint. The XXE payload was crafted to read the file package.json from the application’s current working directory via the symbolic path /proc/self/cwd/package.json. This file contained the challenge flag, confirming that both the authentication bypass and XXE were successfully exploited.

POC:

  1. I have bypass the login with this header X-Middleware-Subrequest: middleware directly access into admin

2. Click on Ice Cream Machines then click on view settings

3. i have used this payload in the XML Configuration Settings

4. Finally grab the flag

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///proc/self/cwd/package.json">
]>
<stockCheck><productId>&xxe;</productId></stockCheck>

Flag :

INTIGRITI{XXE_Redacted_M4ch1n3s}

Reference :

  1. https://app.intigriti.com/researcher/programs/intigriti/challenge-hackdonalds/detail
  2. https://nagasaikiran.com/middleware-mishap-a-deep-dive-into-next-js-cve-2025-29927/

130 thoughts on “HackDonalds Challenge Writeup”

  4. 注册

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

    Reply
  5. redfaptube.com

    I fee tht iss onne oof thhe sso much signiticant infvo forr me.
    Annd i aam happpy readding your article. Howeer wanna renark oon ffew
    nornal issues,Thee weeb site style iss wonderful, thee artticles iis iin point
    off fac gredat : D. Goodd task, cheers

    Feell freee too sujrf tto mmy page :: redfaptube.com

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top