Executive brief
tf2-item-format is a Node.js library that parses Team Fortress 2 item strings and attributes from user input. An attacker can send specially crafted item strings that trigger catastrophic backtracking in the library's regular expression parser, causing the application to hang or consume excessive CPU resources. This could render any service using this library unresponsive to legitimate users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the decomposeName function within src/shared/decomposeName.ts. The vulnerable code constructs a RegExp dynamically from user-controlled input without sanitization, specifically: `new RegExp(\`(( ${toRemove} )|( ${toRemove} ))\`)`, where both `toRemove` and the input string originate from user input. When a specially crafted payload (e.g., containing nested quantifiers like `(a+)+`) is provided, the regex engine experiences catastrophic backtracking. The vulnerability is triggered when parsing item strings via the `parseString()` API function under specific conditions (when usableItem.output or usableItem.target are falsy). Patched versions 5.9.14+ address the issue; v4 users must upgrade to v5 as no patch exists for the v4 branch.
Affected products
- danocmx tf2-item-format 4.2.6 through 5.9.13
Timeline
- 2024-07-23: disclosed
- 2024-07-23: patched: Version 5.9.14 released with fix