CTFd Regular Expression Denial-of-Service Vulnerability

A Regular Expression Denial-of-Service (ReDoS) vulnerability has been identified in CTFd version 3.7.3. The issue arises in the 'validate_email' function located in 'CTFd/utils/validators/__init__.py'. Attackers can exploit this vulnerability by sending a crafted email address during the registration process, causing excessive backtracking in the regular expression engine and leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by introducing significant latency into the email validation process, potentially leading to application timeouts.

Reproduction

To reproduce this vulnerability, send a POST request to the '/register' endpoint with a crafted email address that exploits the regular expression used for validation. The payload should be designed to cause excessive backtracking, such as by including a large number of repeated characters. The 'nonce' value required for the request can be obtained from the registration page.