Add CAPTCHA verification to reset password handler to prevent automated reset attempts

[zeropath-ai-dev]

Summary

• The Vulnerability Description:
  Previously, the password reset handler did not require CAPTCHA verification, allowing attackers to automate bulk password reset attempts and potentially abuse this feature.

• This Fix:
  This patch introduces a CAPTCHA verification step and adds rate limiting to the handler, both of which help prevent automated and excessive password reset requests.

• The Cause of the Issue:
  The handler processed email submissions directly without checking whether the user passed a CAPTCHA, making it susceptible to automated attacks and scripted abuse.

• The Patch Implementation:
  The handler now calls security.verifyCaptcha to ensure the CAPTCHA response is valid before continuing, and uses a simple IP-based rate limit to restrict how often reset requests can be submitted within a short time window.

Vulnerability Details

• Vulnerability Class: Natural Language Rule Violation
• Severity: 6.9
• Affected File: routes/resetPassword.ts
• Vulnerable Lines: 17-29

Code Snippets

diff --git a/routes/resetPassword.ts b/routes/resetPassword.ts
index 235be1b45..7267c63cf 100644
--- a/routes/resetPassword.ts
+++ b/routes/resetPassword.ts
@@ -13,15 +13,34 @@ import { challenges } from '../data/datacache'
 import challengeUtils = require('../lib/challengeUtils')
 const users = require('../data/datacache').users
 const security = require('../lib/insecurity')
+const RATE_LIMIT_WINDOW_MS = 60 * 1000
+const MAX_RESET_PASSWORD_REQUESTS = 5
+const resetPasswordAttempts: Record<string, { count: number, firstRequest: number }> = {}
 
 module.exports = function resetPassword () {
-  return ({ body, connection }: Request, res: Response, next: NextFunction) => {
+  return async ({ body, connection }: Request, res: Response, next: NextFunction) => {
     const email = body.email
     const answer = body.answer
     const newPassword = body.new
     const repeatPassword = body.repeat
     if (!email || !answer) {
       next(new Error('Blocked illegal activity by ' + connection.remoteAddress))
+    } else {
+      const ip = connection.remoteAddress
+      const now = Date.now()
+      let attempt = resetPasswordAttempts[ip]
+      if (!attempt || now - attempt.firstRequest > RATE_LIMIT_WINDOW_MS) {
+        resetPasswordAttempts[ip] = { count: 1, firstRequest: now }
+      } else {
+        attempt.count++
+        if (attempt.count > MAX_RESET_PASSWORD_REQUESTS) {
+          return res.status(429).send(res.__('Too many reset attempts, please try again later.'))
+        }
+      }
+      const captchaValid = await security.verifyCaptcha(body.captcha)
+      if (!captchaValid) {
+        return res.status(401).send(res.__('Captcha verification failed.'))
+      }
     } else if (!newPassword || newPassword === 'undefined') {
       res.status(401).send(res.__('Password cannot be empty.'))
     } else if (newPassword !== repeatPassword) {

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai-dev bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai-dev!

To request modifications, please post a comment beginning with @zeropath-ai-dev and specify the changes required.

@zeropath-ai-dev will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_natural_language_rule_violation_1755147093913529

# if vscode is installed run (or use your favorite editor / IDE):
code routes/resetPassword.ts

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_natural_language_rule_violation_1755147093913529