Invalidate all user sessions and send password-change notification email after successful password update.

[zeropath-ai-dev]

Summary

• The Vulnerability Description:
  After a user changes their password, active sessions remain valid and the user does not receive a notification about the change, increasing the risk that a compromised session or undetected unauthorized password change will go unnoticed.

• This Fix:
  The fix ensures that all active sessions for the user are invalidated after a password update, and a confirmation email is sent to notify the user of the change.

• The Cause of the Issue:
  The original implementation only updated the user's password in the database without terminating existing sessions or informing the user, leaving both user awareness and session security unaddressed.

• The Patch Implementation:
  The patch modifies the password reset handler to explicitly destroy all sessions for the user in the session store and sends an email notification using nodemailer immediately after a successful password change.

Vulnerability Details

• Vulnerability Class: Natural Language Rule Violation
• Severity: 10.0
• Affected File: routes/resetPassword.ts
• Vulnerable Lines: 36-40

Code Snippets

diff --git a/routes/resetPassword.ts b/routes/resetPassword.ts
index 235be1b45..e3024754e 100644
--- a/routes/resetPassword.ts
+++ b/routes/resetPassword.ts
@@ -9,6 +9,7 @@ import type { Memory as MemoryConfig } from '../lib/config.types'
 import { SecurityAnswerModel } from '../models/securityAnswer'
 import { UserModel } from '../models/user'
 import { challenges } from '../data/datacache'
+import nodemailer from 'nodemailer'
 
 import challengeUtils = require('../lib/challengeUtils')
 const users = require('../data/datacache').users
@@ -37,6 +38,28 @@ module.exports = function resetPassword () {
           UserModel.findByPk(data.UserId).then((user: UserModel | null) => {
             user?.update({ password: newPassword }).then((user: UserModel) => {
               verifySecurityAnswerChallenges(user, answer)
+              // Invalidate all existing sessions for this user
+              const sessionStore = (res.req as any).sessionStore
+              if (sessionStore && typeof sessionStore.all === 'function') {
+                sessionStore.all((err: Error | null, sessions: { [sid: string]: any }) => {
+                  if (!err) {
+                    Object.keys(sessions).forEach(sid => {
+                      const sess = sessions[sid]
+                      if (sess.user && sess.user.id === user.id) {
+                        sessionStore.destroy(sid, () => {})
+                      }
+                    })
+                  }
+                })
+              }
+              // Send password change confirmation email
+              const transporter = nodemailer.createTransport(config.get('mail'))
+              transporter.sendMail({
+                from: config.get('mail.from'),
+                to: user.email || '',
+                subject: 'Your Password Was Changed',
+                text: `Hello ${user.email},\n\nYour password has been successfully changed. If this was not you, please contact support immediately.\n`
+              }).catch(console.error)
               res.json({ user })
             }).catch((error: unknown) => {
               next(error)

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai-dev bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai-dev!

To request modifications, please post a comment beginning with @zeropath-ai-dev and specify the changes required.

@zeropath-ai-dev will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_natural_language_rule_violation_1755145341868919

# if vscode is installed run (or use your favorite editor / IDE):
code routes/resetPassword.ts

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_natural_language_rule_violation_1755145341868919