Recent updates

• Support for tracking taint for customers using the com.fasterxml.jackson library for JSON.
• Support for tracking taint for customers using the org.glassfish.jersey framework.
• Internal optimizations.

• Update Apache commons-text from 1.9 to 1.10.0 to mitigate a known CVE (CVE-2022-42889).
• Update Apache httpClient to apache HttpClient5 to mitigate a vulnerability in the old httpClient.
• Support for tracking taint for customers using the org.owasp.encoder.Encode library.
• Improved support for tracking taint for customers using the Gson library, including support for Gson htmlSafe feature.

• Static analysis client updated to 8.0.1514.
• Improved accuracy for Java and Kotlin scanners.
• General bug fixes.

• Performance improvements.
• New configuration option to hide passwords, see here.

As previously announced, for scanning private sites, AppScan Presence v1 is now replaced by AppScan Presence v2, released in March 2022. For private site scanning you now must have v2 Presence installed. See AppScan Presence.

• Now supports TOTP (time-based one time password). See DAST scans.
• Single scan view now includes explore data counters (number of cookies, headers etc. found).

• SARIF format option added to the Export Issues dialog.
• Single scan view now includes list of languages found, and (if subscription includes SCA) counters for open source libraries and licenses found.

• Support for tracking data sent over WebSockets.
• Extended support for Spring REST API: Support for REST path variables as sources.
• Support for tracking taint for customers using the Gson library.
• When using Java 9 and higher, a flag (BC_SB) must be set in the java properties to properly track taint. Users are now alerted if this flag is not set.

• Applications view: Filter by Risk rating, Asset group, Business impact, Business unit, Testing status, Max severity. Select start and end dates.
• Scans view: Filter by Technology and Status (unchanged).
• All issues view: Filter by Severity, Status, Scan technology, Enables policies, Issue type. Select start and end dates.
• Scan issues view: Filter by Severity, Status, First found, Enabled policies. Select start and end dates.

• New Preferences section in the Scan > Configuration tab shows how Notification email (Send / Don't send) and Scan enablement (Allow / Don't allow) are configured for the scan.
• The updated Rescan dialog lets you change these two settings when rescanning.

Note that while automatic API scanning using an imported Postman Collection file is supported in AppScan Standard 10.0.8, uploading a Postman Collection scan to ASoC is not currently supported.

• You can now change the severity level of an issue, or of multiple issues together (see Edit issue severity).
• New indication for scans that are “Completed” but with less than 100% visited pages and/or 100% tested elements. New “Partial scans” filter to view/hide these scans (see Partial scans).
• Administrators: In role assignment, the “Create scan” and “Rescan” permissions are now separated, so users can be given permission to do one, or the other, or both.

• Support for JBoss EAP (Enterprise Application Platform) versions 6,7
• Improved report readability:
  • Print array/map content
  • Dynamic generation of exploit example based on current user input
• Improved XSS algorithm

• Added 'OWASP Open API Top 10 2019' policy
• Added Critical severity to the scan card and to the single scan issues graph

• Added SAST open-source resolution and description columns to CSV reports
• Added Critical severity counters to security reports

• The new AppScan Traffic Recorder (previously called the DAST Proxy) is now available on the ASoC Plugins and APIs page. See AppScan Traffic Recorder.
• Three new JetBrains plugins added: CLion, GoLand and RubyMine.

This means that DAST scans started from the API, or from the plugins, will not be sent to the Scan Enablement Team for review (see Scan status: Under review) unless the user specifically sets the parameter to false.

For scans started through the UI, the default setting - “Allow intervention” - remains unchanged.

• New supported environments: Jetty server, Quarkus (JVM Node), Resteasy framework
• Security updates:
  • New vulnerability: Unsafe reflection (CWE 470). Reference: https://cwe.mitre.org/data/definitions/470.html
  • New vulnerability: Open redirect (CWE 601). Reference: https://cwe.mitre.org/data/definitions/601.html
  • Improved accuracy of injection analysis algorithms - affects CWE 78: OS Command Injection)
  • Eliminate potential False positives when page not found - affects CWE 352 (CSRF) and 523 (Unprotected transport of credentials)
  • Additional information added to issues of CWE 352 (CSRF) and CWE 523 (Unprotected transport of credentials)

• CLion
• GoLand
• RubyMine

• Call trace information improved for all vulnerabilities
• Sink URL is now the main issue URL

• Note: The legacy Presence (V1) is still supported, but will not be supported after October 1, 2022.
• Note: The new Presence (V2) does not include the DAST proxy. If you need this, you can download and use the legacy Presence (V1).

• Improved ‘Create scan’ flow for DAST scans
• Added Guided Explore and Scheduler when creating a DAST scan from a file
• Added ability to create open-source license report at application level
• Added ability to add a comment to multiple issues

• CWE/SANS Top 25 report ASREG in ASoC is replaced by CWE Top 25 Most Dangerous Software Weaknesses 2021
• Libraries table added to the Open-Source Report Summary

• Added ability to add a comment to multiple issues

• Select which days of the week a scheduled scan will run
• Add a schedule to an existing scan
• Remove the schedule from a scheduled scan
• The recurrence end date (last date that a scan is scheduled to run) is now shown in the scan entry

• XXE on JaxB class (CWE 661). This potentially vulnerable class is mentioned in this OWASP XXE documentation: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxb-unmarshaller
• JSON XSS informational issue (CWE 79), an XSS variant of vulnerable data written to the response as JSON

• Scan cards redesigned and now include a link to the issues per severity in the scan.
• Rider plugin added to the ‘Plugins & APIs’ page.

• Added ability to define the ‘Recurrence End Date’ from the post DAST scan API.
• Added support for viewing issues found for the first time in the application.
• Language property added to new SAST issues.