A critical Regular Expression Denial of Service vulnerability in Flag Forge versions 2.3.2 and below enables unauthenticated attackers to crash the application by exhausting server CPU resources.

The application is susceptible to a Regular Expression Denial of Service (ReDoS) attack because it dynamically constructs regex patterns using unescaped user input within the /api/user/[username] endpoint. An unauthenticated attacker can exploit this by submitting a username containing complex regex meta-characters, which forces the MongoDB regex engine to consume excessive CPU resources.

The exploitation of this vulnerability directly impacts system availability, potentially rendering the Capture The Flag platform inaccessible to all users. With a CVSS score of 7.5, the risk is classified as High, reflecting the ease of exploitation and the significant disruption to operations. Prolonged downtime can result in loss of service availability and reputational damage for the hosting organization.

Immediate Action: Upgrade Flag Forge to version 2.3.3 or later to incorporate the necessary input sanitization and regex fixes.

Proactive Monitoring: Monitor server CPU utilization and review access logs for requests directed at the /api/user/ endpoint that contain unusual character patterns or excessive length.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing regex meta-characters within the URL path as a temporary mitigation.

Public Exploit Available: No (exploit_available: unknown)

Given the high impact on service availability and the simplicity of the attack vector, organizations should prioritize the update to version 2.3.3. If an immediate patch is not feasible, the application of WAF rules to filter malicious traffic is essential to protect the platform from potential service disruption.