VNX-804: Guessable CAPTCHA

Reports home-grown CAPTCHA code in JavaScript/TypeScript and Python that an automated client can solve without solving the challenge: (1) the challenge text or digits come from a predictable generator (Math.random(), or random.choice/choices/randint/randrange/random/sample/getrandbits) on a line that names a captcha, inside a function or class whose name contains captcha, or in a file whose name contains captcha; (2) the expected answer is sent to the client: res.json/res.send/ctx.body/jsonify/JsonResponse with an answer or solution key (including the shorthand { answer }), with a captcha object's .text/.answer/.solution/.code, or with a variable built a few lines above as an object holding an answer/solution key or returned by svgCaptcha.create; (3) verification fails open, so a request naming an unknown CAPTCHA id passes: an accept condition `if (!stored || given === stored.answer)` / `if not stored or ...` / `if stored is None or ... == ...`, or a reject condition that only fires when the stored CAPTCHA exists, `if (stored && stored.answer !== given)` / `if stored is not None and stored.answer != given`. Not reported: fail-closed checks (`if (!stored || stored.answer !== given)` rejecting), crypto.randomInt/randomBytes, secrets, random.SystemRandom, randomness outside captcha code, responses that omit the answer (svgCaptcha's .data), answers stored server side, third-party services (reCAPTCHA, hCaptcha, Turnstile), comments and test files.

Field	Value
Rule ID	`VNX-804`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, Python
CWE	CWE-804
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`captcha-bypass` `cwe-804`
Source	`internal/sast/rules/vnx-804.rego`

Overview

VNX-804 maps to CWE-804: Guessable CAPTCHA. It reports three ways a home-grown CAPTCHA stops a human but not a bot: a predictable generator, an answer sent to the client, and a verification that passes when the stored challenge is missing.

What Gets Flagged

// FLAGGED: predictable challenge
const captchaCode = Math.random().toString(36).slice(2, 8);

// FLAGGED: the object sent holds the answer
const captcha = { captchaId: nextId(), captcha: expression, answer };
res.json(captcha);

// FLAGGED: an unknown captcha id passes
if (!captchas[0] || req.body.answer === captchas[0].answer) { return next(); }

# FLAGGED: the solution is returned with the question
return jsonify({"question": question, "solution": solution})

# FLAGGED: random.randint in captcha code
code = random.randint(1000, 9999)

Not flagged: crypto.randomInt(...), secrets.choice(...), random.SystemRandom(), a response that sends only the id and the image, reCAPTCHA verification.

// FLAGGED: rejects only when the stored CAPTCHA exists, so an unknown id passes
if (captcha && captcha.answer !== String(req.body.captcha)) {
  return res.status(401).json({ error: 'Wrong answer' });
}

// FLAGGED: shorthand answer key in the response
res.json({ captchaId, question: `${a} + ${b} = ?`, answer });

Not flagged: the fail-closed if (!entry || entry.answer !== given) return res.status(400), and res.send(captcha.data) from svg-captcha with captcha.text kept in the session.

Remediation

Generate challenges with a cryptographic generator (crypto.randomInt, secrets).
Keep the answer server side, keyed by a single-use id, and never include it in a response.
Reject when the stored challenge is missing, then delete it after one attempt.
Prefer an established service (reCAPTCHA, hCaptcha, Turnstile) over a home-grown CAPTCHA.

References

CWE-804: Guessable CAPTCHA

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-804
// nosec vnx-804

Or record an ignore rule: vulnetix ignore add --rule vnx-804 --reason "...". See Suppressing findings.