VNX-620: Password change that does not verify the current password

Field	Value
Rule ID	VNX-620
Severity	High
SARIF level	error
Kind	sast
Languages	C#, Java, JavaScript / TypeScript, Python
CWE	CWE-620
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H
Tags	unverified-password-change authentication cwe-620
Source	internal/sast/rules/vnx-620.rego

Overview

VNX-620 maps to CWE-620: Unverified Password Change. If a change-password endpoint does not ask for the current password, anyone holding the session (a stolen cookie, a CSRF request, an XSS payload) can take over the account for good.

The rule looks for a password write (set_password(), setPassword(), an assignment to user.password, an ORM update/$set of password, or UPDATE ... SET password) in a handler named or routed as a password change that reads the request, with no current-password check in the 40 lines above. A check guarded by if (currentPassword && ...) does not count, because the client can skip it by leaving the current password out.

What Gets Flagged

@bp.route("/change_password", methods=["POST"])
def change_password():
    new_password = request.form["new_password"]
    current_user.set_password(new_password)      # flagged

if (currentPassword && hash(currentPassword) !== user.password) {
  return res.status(401).send('Current password is not correct.')
}
await user.update({ password: newPassword })     // flagged: the check is optional

user.setPassword(passwordEncoder.encode(form.getNewPassword()));  // flagged

lblResult.Text = store.UpdateAccountPassword(accountId, txtNew.Text);  // flagged: no current-password check

Not flagged: handlers that call check_password, bcrypt.compare, PasswordEncoder.matches, password_verify or compare against an old/current password; Django’s PasswordChangeForm; password-reset, invitation and activation flows; administrator endpoints; registration; test files.

Remediation

Require the current password and verify it before writing the new one:

if not current_user.check_password(request.form["old_password"]):
    abort(403)
current_user.set_password(request.form["new_password"])

References

• CWE-620: Unverified Password Change
• OWASP Authentication Cheat Sheet: Change password feature

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-620
// nosec vnx-620

Or record an ignore rule: vulnetix ignore add --rule vnx-620 --reason "...". See Suppressing findings.