Skip to main content

Release Updates (v3.0.0)

The following release updates are available for CxIAST version 3.0.0. Use the search tool to find a specific subject.

New Features and Changes

CxIAST version 3.0.0 includes the following new features and changes:

Category

Feature

Setup & Configuration

Version upgrade: If you have version 2.6.1 or below installed, it is required to clean the DB and uninstall the version before upgrading to v3.0.0 installation.

Docker Deployment - Running CxIAST Server in a Docker container.

CxIAST Server in AWS (for POC) - New process that allows running a POC in AWS (details to be shared soon).

Action Ability and Usability

Agent Tags: New parameters used during the agent deployment:

  • Application tag - Add a tag to an application. This allows to differentiate two applications with the same name or for easy filtering in the user interface (e.g., Application_1 will be Checkmarx:Application_1).

  • Scan tag - Add a tag to a scan. This allows to differentiate two different tests and to relate a scan in CxIAST to build version or test name. The scan tag is presented per scan in the scan list table.

  • Team name - Allow auto attachment of team to any of the applications discovered by the agent.

Vulnerability Actions:

  • View and Add Comments - Comment on a specific vulnerability and view old comments and log on past activates (state, status or severity change, user assignment and state suggestions).

  • Change Severity - Allows changing a specific vulnerability Severity.

  • Suggest and Approve State - New change state flow. Based on permissions some users can only suggest new state, while privileged users can approve the suggestion.

Import Scans: Allows importing scans from one project to another. This allows for monitoring two versions of same application providing the capability to transfer existing scan information from the old version to the new version.

Node.js – GA Version

Version Highlights:

  • GA version – Full agent capabilities

    • Major performance improvements

    • Auto update

    • Analysis mode

    • Agent logs export

    • SSL support

    • Custom instrumentation

  • Supported versions: Node.js 6 and above

  • Supporting all Web frameworks

  • Ecmasript6 and below

Supported databases: MongoDB, MySQL and PostgreSQL

Supported Vulnerabilities:

  • Command Injection

  • Deserialize Vulnerability

  • LDAP Injection

  • SQL Injection

  • Second Order Command Injection

  • Second Order LDAP Injection

  • Second Order SQL Injection

  • Second Order XPath Injection

  • Sensitive Data Exposure Credit Card

  • Session Id Disclosure

  • Stored XSS

  • XPath Injection

  • XSS

  • App DOS Database Connections

  • Blind SQL Injection

  • CSRF

  • Failed Login Without Audit

  • Log Forging

  • Open Redirect

  • Path Traversal

  • Second Order Path Traversal

  • Sensitive Data Exposure Email

  • Insecure Cookie

  • Insecure Outgoing Communication

  • Least Privilege Violation

  • Outgoing Connection Discovery

  • Successful Login Without Audit

  • Weak Cryptography

  • Weak DB Password

  • Weak Hashing

  • Weak Random

  • Application Entry Point

  • CORS

  • Click Jacking

  • Missing X Content Type Options Header

  • Missing X XSS Protection Header

  • Sensitive Data Exposure Long Number

C# - GA Version

Version Highlights:

  • Major performance improvements

  • SSL support

  • Supported frameworks: version 3.5 and above

  • Web servers supported: IIS and IIS Express

  • Any Web applications or REST/SOAP applications

Supported Vulnerabilities:

  • Command Injection

  • LDAP Injection

  • SQL Injection

  • Second Order Command Injection

  • Second Order LDAP Injection

  • Second Order SQL Injection

  • Second Order XPath Injection

  • Sensitive Data Exposure Credit Card

  • Session Id Disclosure

  • Stored XSS

  • XPath Injection

  • XSS

  • Insufficient Session Expiration

  • Log Forging

  • Open Redirect

  • Path Traversal

  • Second Order Path Traversal

  • Sensitive Data Exposure Email

  • Insecure Cookie

  • Insecure Outgoing Communication

  • Least Privilege Violation

  • Outgoing Connection Discovery

  • Weak Cryptography

  • Weak DB Password

  • Weak Hashing

  • Weak Random

  • Application Entry Point

Known Limitations

Category

Limitation

.NET Agent

  • C# and ASP.NET only

  • Missing capabilities (compared to Java)

    • Query customization is performed manually (not from the UI)

    • SAST Correlation

    • Code Coverage

Node.js agent

  • js v10 is not supported

  • Missing capabilities (compared to Java)

    • SAST Correlation

    • Code Coverage

Java agent

· Java 11 is not supported

The release update is also available for download here.

Send Documentation Feedback - If you have comments about this documentation, you can contact the documentation team by sending your feedback to us. We appreciate your feedback!

In this section: