Add password reset token verification to prevent unauthorized password changes in resetPassword route

[zeropath-ai-dev]

Summary

• The Vulnerability Description:
  The application previously allowed users to reset their passwords without verifying a cryptographically secure reset token, exposing the password change process to unauthorized resets and account takeovers.

• This Fix:
  The patch adds a requirement for a valid password reset token and verifies it before allowing any password changes, ensuring that only authorized users can perform this action.

• The Cause of the Issue:
  Password updates were performed solely on the basis of correctly answering a security question, without any additional checks for a secure, time-limited reset token.

• The Patch Implementation:
  A new conditional checks for the existence and validity of a reset token using security.verifyPasswordResetToken(token, email); the password is only updated if this check passes, otherwise an error is returned.

Vulnerability Details

• Vulnerability Class: Natural Language Rule Violation
• Severity: 10.0
• Affected File: routes/resetPassword.ts
• Vulnerable Lines: 38-40

Code Snippets

diff --git a/routes/resetPassword.ts b/routes/resetPassword.ts
index 235be1b45..2ac92eaf0 100644
--- a/routes/resetPassword.ts
+++ b/routes/resetPassword.ts
@@ -35,12 +35,17 @@ module.exports = function resetPassword () {
       }).then((data: SecurityAnswerModel | null) => {
         if ((data != null) && security.hmac(answer) === data.answer) {
           UserModel.findByPk(data.UserId).then((user: UserModel | null) => {
-            user?.update({ password: newPassword }).then((user: UserModel) => {
-              verifySecurityAnswerChallenges(user, answer)
-              res.json({ user })
-            }).catch((error: unknown) => {
-              next(error)
-            })
+            const token = body.token
+            if (!token || !security.verifyPasswordResetToken(token, email)) {
+              res.status(401).send(res.__('Invalid or missing password reset token.'))
+            } else {
+              user?.update({ password: newPassword }).then((user: UserModel) => {
+                verifySecurityAnswerChallenges(user, answer)
+                res.json({ user })
+              }).catch((error: unknown) => {
+                next(error)
+              })
+            }
           }).catch((error: unknown) => {
             next(error)
           })

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai-dev bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai-dev!

To request modifications, please post a comment beginning with @zeropath-ai-dev and specify the changes required.

@zeropath-ai-dev will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_natural_language_rule_violation_1755147123662791

# if vscode is installed run (or use your favorite editor / IDE):
code routes/resetPassword.ts

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_natural_language_rule_violation_1755147123662791