Кошачья CVEтыня

Platform: bug-makers | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-25 | Status: Solved Techniques: nextjs_middleware_subrequest_bypass, authentication_bypass_via_cve

Summary

Task: Next.js application with middleware-based authentication protecting /forbidden route, outdated framework version. Solution: CVE-2025-29927 — bypass middleware auth by sending x-middleware-subrequest header with 5 colon-separated entries to skip middleware execution.

Кошачья CVEтыня — Bug Makers CTF

Description

Мы узнали, что в комнате жрицы скрывается ценная информация. Но доступ туда только ограниченному кругу лиц. Возможно, есть способ пробраться окольными путями, так как бекенд сайта давно не обновлялся.

English summary: A "Cat Sanctuary" themed Next.js web application has a protected route /forbidden ("Priestess Room") that redirects unauthenticated users to /login. The challenge name is a wordplay on "CVE" + "святыня" (sanctuary), and the description explicitly states the backend hasn't been updated — hinting at exploiting a known CVE in the framework. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

Reconnaissance

1. Framework identification: The X-Powered-By: Next.js response header and Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch headers confirmed a Next.js application.
2. Build ID: LL75xgt4tpHxq5hPlEK0D (visible in page source/data routes).
3. Site structure: A themed "Cat Sanctuary" (Кошачья Святыня) with navigation links including Для жрицы (For the Priestess) linking to /forbidden.
4. Authentication mechanism: Accessing /forbidden returned a 307 Temporary Redirect to /login?from=%2Fforbidden, indicating middleware-based authentication protecting the route. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability Identification

The challenge name "Кошачья CVEтыня" directly encodes the hint — this is about exploiting a known CVE. Combined with:

• Next.js framework detection
• Middleware-based authentication pattern (307 redirect)
• "Backend hasn't been updated" in the description

This pointed to CVE-2025-29927 — a critical Next.js middleware authorization bypass vulnerability.

CVE-2025-29927 Details

Next.js uses an internal header x-middleware-subrequest to track middleware recursion depth and prevent infinite loops. The vulnerability exists because: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. When Next.js processes a request, it checks the x-middleware-subrequest header for colon-separated middleware identifiers.
2. If the header contains 5 or more entries matching the middleware name, the framework assumes it's stuck in a recursive loop.
3. To break the "loop", it skips middleware execution entirely — including any authentication/authorization middleware.

An external attacker can craft this header to bypass all middleware-based security checks.

Solution

The exploit is a single HTTP request with the crafted header: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
  http://31.207.77.216:4022/forbidden

This bypassed the authentication middleware and returned the "Комната жрицы" (Priestess Room) page directly, which contained the flag.

The response included the protected page content with:

Флаг: BugCTF{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍