From 22b2e5e3177a644a97ff292055dfda0f1cf3a399 Mon Sep 17 00:00:00 2001
From: Dominique RIGHETTO <righettod@users.noreply.github.com>
Date: Mon, 22 Jul 2024 20:43:04 +0200
Subject: [PATCH 1/2] Update checkmarx-panel.yaml

---
 .../checkmk/checkmarx-panel.yaml              | 30 ++++++++++++++-----
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/http/exposed-panels/checkmk/checkmarx-panel.yaml b/http/exposed-panels/checkmk/checkmarx-panel.yaml
index a3c61350ed..71b8b342bc 100644
--- a/http/exposed-panels/checkmk/checkmarx-panel.yaml
+++ b/http/exposed-panels/checkmk/checkmarx-panel.yaml
@@ -1,25 +1,39 @@
 id: checkmarx-panel-detect
 
 info:
-  name: Checkmarx WebClient Login Panel - Detect
-  author: joanbono
+  name: Checkmarx Login Panel - Detect
+  author: joanbonon,righettod
   severity: info
-  description: Checkmarx WebClient login panel was detected.
+  description: Checkmarx login panel was detected.
+  reference:
+    - https://docs.checkmarx.com/en/34965-44074-checkmarx-sast.html
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
     cwe-id: CWE-200
   metadata:
     max-request: 1
-  tags: panel,checkmarx
+    verified: true
+    shodan-query: http.html:"CxSASTManagerUri"
+  tags: panel,checkmarx,detect,login
 
 http:
   - method: GET
     path:
+      - "{{BaseURL}}/cxrestapi/help/system/version"
       - "{{BaseURL}}/cxwebclient/Login.aspx"
+      - "{{BaseURL}}/cxrestapi/auth/identity/.well-known/openid-configuration"
 
+    stop-at-first-match: true
     matchers:
-      - type: word
-        words:
-          - '/CxWebClient/webApp/Scripts/libs/authenticationScripts'
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_any(to_lower(body), "cxsastmanageruri", "cxauthorityconfigurations", "/cxwebclient/webapp/", "sast_api", "sast_rest_api" , "sast-permissions", "hotfix")'
+        condition: and
+
+    extractors:
+      - type: regex
         part: body
-# digest: 4a0a00473045022073859fd8e881a46904e753b8ac158d4bf504e86ac1ff4e60a5acb794053af8b0022100ef4b06e978f467ae8e190aaa645ebc973b774efa6c29b77423c91459063522c6:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
+        group: 1
+        regex:
+          - '(?i)"version":\s*"([0-9.]+)"'

From 6d4e6c28f8d0e75161e21a5dbdf75d198238a4f9 Mon Sep 17 00:00:00 2001
From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
Date: Tue, 23 Jul 2024 12:02:20 +0530
Subject: [PATCH 2/2] Update checkmarx-panel.yaml

---
 http/exposed-panels/checkmk/checkmarx-panel.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/http/exposed-panels/checkmk/checkmarx-panel.yaml b/http/exposed-panels/checkmk/checkmarx-panel.yaml
index 71b8b342bc..2c47d6ed1d 100644
--- a/http/exposed-panels/checkmk/checkmarx-panel.yaml
+++ b/http/exposed-panels/checkmk/checkmarx-panel.yaml
@@ -4,14 +4,15 @@ info:
   name: Checkmarx Login Panel - Detect
   author: joanbonon,righettod
   severity: info
-  description: Checkmarx login panel was detected.
+  description: |
+    Checkmarx login panel was detected.
   reference:
     - https://docs.checkmarx.com/en/34965-44074-checkmarx-sast.html
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
     cwe-id: CWE-200
   metadata:
-    max-request: 1
+    max-request: 3
     verified: true
     shodan-query: http.html:"CxSASTManagerUri"
   tags: panel,checkmarx,detect,login