Executive brief
nitrado.js is a Node.js library for interacting with Nitrado game server APIs. The library contains a regular expression vulnerability that can be exploited to cause a denial of service (ReDoS attack) by sending specially crafted input containing repeated "{{|" patterns, causing the application to hang or become unresponsive.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by a polynomial regular expression that processes uncontrolled user input. An attacker can craft input strings with patterns like "{{" followed by many repetitions of "{{|" to trigger catastrophic backtracking in the regex engine, consuming CPU resources and causing the application to hang. The vulnerability affects all versions prior to 0.2.5, which includes a patch. The attack requires only network access to send malicious input and does not require authentication or user interaction.
Affected products
- cainthebest nitrado.js all versions prior to 0.2.5
Timeline
- 2022-08-31: disclosed
- 2022-08-31: patched: Patched in version 0.2.5