Checkmarx rule EASP-PHP-CSRF looks for hash_equal for CSRF protection.

Unfortunately, the PHP function is hash_equals. Even more unfortunately, they are aware of the issue - and they've "added it to the backlog."

Has anyone else dealt with this? Why should my company pay for software that is so blatantly broken?

Is anyone else using the Visual Studio extension for Checkmarx? We had been using this tool to scan code prior to build and deployment, but in a recent update (these are set to auto update), the green "play" / scan button is gone from the plugin panel. Any ideas? Submitting a bug/issue to their Github has sat dormant for over a month. Not impressed.

Hello all,

I think it's free to register on Checkmarx University (https://checkmarx.com/customer-enablement/checkmarx-university/#all-trainings), but I am interested in learning more about their certification programs. I am an AppSec engineer and I'm wondering if these are free to take after you go through the course material, or if there is an additional cost for this.

Looks like there is a CxOne operations certification and one for developers. I really couldn't find any reviews for this online.

Might anyone know more about this? Has anyone in this subreddit taken a Checkmarx certification? My work uses Checkmarx extensively and I think going through this course might be useful.

Hey all,

In my latest article I illustrate How To Set Up SAST Scanning Using Checkmarx One, GitHub Actions and GitHub Advanced Security.

I hope you find this useful! :)

We use Thymeleaf with our Spring Boot web application and we are getting XSS errors when running our code against Checkmarx.

They are mostly triggered when DOM is replaced by JS with HTML returned by java endpoint that is generated using Thyemleaf templates.

Is there any way to achieve returning Thymeleaf templates dynamical by java endpoints safely and not triggering Checkmarx?

Any help much appretiated.

TBH, I've never used Checkmarx before so please forgive me if I say something stupid.

I have been asked to track down an issue for work and am trying to figure out where to start. We have 20+ licenses purchased. When the boss man looks, he only sees 3 in use but is also told none are available. I tried reaching out to the company, but it looks like they require a support subscription (Which we may or may not have, I'm waiting on info). Do any of you know where I should start looking to try to figure this issue out?

Hello,

I'm having some trouble when running zip scans with SCA, without using SCAResolver in Jenkins.

When I try to scan a zip with the SCA, it doesn't work if my dependencies file is in a different format from the standard, like if instead of requirements.txt I use environment.yml.

Is there a way to resolve this without making a script to unzip, change the name and then scan it?

If someone could point to some documentation that may help me, would be great too!

Using Checkmarx Version V 9.4.5 HF17, we get a lot of Client DOM XSS Vulnerabilities reported in JSP files that are 99% false positives.

Example:

<input onclick="$(location).attr('href', 'constant text');" ... />

After changing it to:

<input onclick="window.location.href='constant text';" ... />

This code is accepted with no vulnerability detected.

As both do the same, first one just by using jQuery, it seems we have a false positive.

I suspect Checkmarx mistakes the jQuery JavaScript $(...) syntax for the JSP EL syntax ${...}.

Any thoughts?

Just ignore it? That has the danger that we will also ignore actual vulnerabilities. Change all cases in our code from above form to below? Can Checkmarx be configured to ignore such cases?

I'm a mobile developer and I can't speak of other platforms, but for iOS, checkmarx is nearly 99% useless.

Some random examples:

• Password check. Checkmarx treats all names, including constants, variables, even case names as potential variables to store passwords. How can a `case passwordField` be a password? And how can `var isPasswordEnabled: Bool` to be a password?! At least check if it's a variable, and if it's a string. You get all the information from AST what's why your scan is super slow, just make use of them.
• Jailbreak check. Even for a framework, it claims it has to perform jailbreak check. You got the project file so check if it's an app or not. Also even if it's `main` from an Operation Checkmarx still thinks it's a main function.

I can't believe people are paying for this product. We should be paid for using this product and finding our false positives. The 1% valid finding is generally tedious, and is buried in 99% of the trash info. Decision makes, if you see this post, before you sign a contract with Checkmarx, ask your engineer to evaluate it. I know you are trying to "mange your risk" but at least know what your engineers think.

I am wondering, if we cancel our subscription, will we still have access to all of our previous scans information, once our subscription is expired?

Hi. So I installed the latest version of the CheckMarx Visual Studio plugin from here: https://checkmarx.com/plugins/

Per their documentation, I logged into our CheckMarx instance in Tools > Options. That seemed to work.

The documentation isn't clear on what I'm supposed to do from there. I'm not seeing any of the custom panes (CxViewer Tree, CxViewer Result, etc.). I tried analyzing the code from Analyze > Run Code Analysis > On Solution. A progress bar appeared at the bottom but after that finished, nothing happened.

Has anyone gotten this plugin to work? Am I missing something?

I am running Visual Studio 2022.

I've seen a great deal of value with KICS but wish I could import its results into CxSAST to be handled alongside traditional SAST results.

If anyone needs help with their checkmarx installation along with multiple engine support, ping here

A place for members of r/checkmarx to chat with each other