Fix improper lockout on password reset by tracking failed attempts and enforcing account lock after five incorrect answers in TypeScript handler.

[zeropath-ai-dev]

Summary

• The Vulnerability Description:
  The password reset handler does not limit failed security question attempts or lock the user’s account after repeated failures, allowing attackers to try answers indefinitely (brute-force).

• This Fix:
  Introduces a mechanism to track failed reset attempts per user and enforces account lockout for 30 minutes after five consecutive failed attempts.

• The Cause of the Issue:
  The original implementation lacked logic for counting failed answers and did not invoke account lockout or return error responses based on the number of failures.

• The Patch Implementation:
  Added a count and timestamp tracker for failed attempts, reset on successful answer or after lockout duration, and sends appropriate responses to block attackers after the threshold is reached.

Vulnerability Details

• Vulnerability Class: Natural Language Rule Violation
• Severity: 6.9
• Affected File: routes/resetPassword.ts
• Vulnerable Lines: 47-49

Code Snippets

diff --git a/routes/resetPassword.ts b/routes/resetPassword.ts
index 235be1b45..176e8e12f 100644
--- a/routes/resetPassword.ts
+++ b/routes/resetPassword.ts
@@ -14,6 +14,10 @@ import challengeUtils = require('../lib/challengeUtils')
 const users = require('../data/datacache').users
 const security = require('../lib/insecurity')
 
+const resetFailures: Record<string, { count: number, firstAttempt: number }> = {}
+const MAX_RESET_ATTEMPTS = 5
+const LOCKOUT_DURATION = 30 * 60 * 1000 // 30 minutes
+
 module.exports = function resetPassword () {
   return ({ body, connection }: Request, res: Response, next: NextFunction) => {
     const email = body.email
@@ -27,6 +31,16 @@ module.exports = function resetPassword () {
     } else if (newPassword !== repeatPassword) {
       res.status(401).send(res.__('New and repeated password do not match.'))
     } else {
+      const now = Date.now()
+      const attempts = resetFailures[email]
+      if (attempts) {
+        if (now - attempts.firstAttempt > LOCKOUT_DURATION) {
+          delete resetFailures[email]
+        } else if (attempts.count >= MAX_RESET_ATTEMPTS) {
+          res.status(429).send(res.__('Too many failed attempts. Try again later.'))
+          return
+        }
+      }
       SecurityAnswerModel.findOne({
         include: [{
           model: UserModel,
@@ -38,6 +52,7 @@ module.exports = function resetPassword () {
             user?.update({ password: newPassword }).then((user: UserModel) => {
               verifySecurityAnswerChallenges(user, answer)
               res.json({ user })
+              delete resetFailures[email]
             }).catch((error: unknown) => {
               next(error)
             })
@@ -45,7 +60,17 @@ module.exports = function resetPassword () {
             next(error)
           })
         } else {
-          res.status(401).send(res.__('Wrong answer to security question.'))
+          const now = Date.now()
+          if (!resetFailures[email]) {
+            resetFailures[email] = { count: 1, firstAttempt: now }
+          } else {
+            resetFailures[email].count++
+          }
+          if (resetFailures[email].count >= MAX_RESET_ATTEMPTS) {
+            res.status(429).send(res.__('Too many failed attempts. Try again later.'))
+          } else {
+            res.status(401).send(res.__('Wrong answer to security question.'))
+          }
         }
       }).catch((error: unknown) => {
         next(error)

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai-dev bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai-dev!

To request modifications, please post a comment beginning with @zeropath-ai-dev and specify the changes required.

@zeropath-ai-dev will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_natural_language_rule_violation_1755147149888390

# if vscode is installed run (or use your favorite editor / IDE):
code routes/resetPassword.ts

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_natural_language_rule_violation_1755147149888390