R3CTF 2026 P1gROXY (high-level)

What it is. R3CTF 2026 pwnable: P1gROXY, a C++ HTTP/1.1 reverse proxy in front of an internal “WarehouseHub” status service (Flask/gunicorn). Only the proxy is meant to be public.

Challenge theme / architecture facts.

• Proxy rewrites private upstream absolute URLs in HTML responses into public paths
• Attribute values such as href / src / action are HTML-escaped during that rewrite
• Keep-alive handling and an optional response cache (keyed in part by request target and Accept) are part of the service design

Root-cause concept (plain language)

• Output buffer sized from input length: escaping can expand strings (for example, a single & becoming a multi-character entity)
• If the destination buffer is allocated from the pre-escape length, expanded output can write past the allocation — a heap buffer overflow class bug
• That is a classic memory-safety footgun in manual string rewriting, independent of any later CTF heap-grooming narrative

Impact (abstract)

In the contest setting, memory corruption in the proxy process can lead to information disclosure or control-flow hijack inside the challenge sandbox. In production terms: a reverse proxy that mishandles response rewriting is a high-value crash/RCE surface because it terminates TLS and sees many responses.

Mitigations / lessons

• Size (or grow) escape buffers for worst-case expanded length; prefer safe string builders
• Fuzz HTML rewrite / escape paths with entity-heavy inputs
• Deploy hardened allocators, CFI, and least-privilege proxy workers
• Keep debug caches and verbose error bodies from reflecting raw heap state

Solve steps and PoC omitted.