A vulnerability in the Sync-in Server sync diff endpoint allows an authenticated attacker to trigger a denial of service by exploiting inefficient regular expression complexity.

The application fails to validate the complexity of user-supplied strings before compiling them into a RegExp object. This allows an authenticated attacker to submit a catastrophic-backtracking pattern, which blocks the Node.js event loop and renders the server unresponsive.

Successful exploitation of this vulnerability results in a complete denial of service for all users of the Sync-in platform. Because the attack causes the event loop to hang, the service remains unavailable until the underlying container is manually restarted, leading to significant operational downtime and productivity loss. While the CVSS score of 6.5 reflects a medium severity, the impact on availability is absolute for the affected instance.

Immediate Action: Update the Sync-in Server package to version 2.4.0 or later to apply the necessary regular expression validation logic.

Proactive Monitoring: Review application logs for unusually long processing times or repeated timeouts associated with the sync diff endpoint.

Compensating Controls: Implement input length validation and regex complexity limits at the Web Application Firewall (WAF) layer to drop malicious payloads before they reach the server.

Public Exploit Available: No (exploit_available: unknown)

Given the ease with which a single authenticated user can force a system-wide outage, organizations should prioritize upgrading to version 2.4.0 immediately. While an active exploit is not currently confirmed in the wild, the existence of proof-of-concept data necessitates swift action to harden the infrastructure against this denial of service vector.