Just saw the advisory cross-posted from a CERT feed. Apparently, the Checkmarx CxSAST engine has a path traversal vulnerability in its analysis component (CVE-2024-XXXXX, if you want to look it up). The irony is so thick you could spread it on toast.
A static application security testing tool, used to find vulnerabilities in code, has a vulnerability in its own code that could allow arbitrary file reads on the host system. You’d think the SAST engine would have, I don’t know, scanned itself? I guess not.
Details are still sparse, but the advisory suggests it's related to how the engine processes certain analysis configurations. If you're running an on-premise version, you need to apply the patch immediately. The cloud-hosted offering should already be remediated, but given the black box nature of it, who really knows? I'd be curious to see if this flaw could be triggered to affect the integrity of scan results themselves, or if it's just a classic path traversal to the underlying server.
This is exactly why I'm skeptical of vendor benchmarks and "proprietary" engines. If their methodology isn't transparent or reproducible, how do you trust the output? Now we have a concrete example where the tool itself is the attack vector. Makes you wonder what other quality control issues are lurking under the hood that aren't severe enough to get a CVE.
Data skeptic, not a data cynic.