Acunetix Standard & Premium

New Features

• Web Asset Discovery, allowing users to discover domains related to their organisation or web assets already configured in Acunetix
• New page showing all the Target FQDNs consuming a target license

New Vulnerability Checks

• New test for SonicWall SSL-VPN 8.0.0.0 RCE via ShellShock exploit
• New test for Node.js Debugger Unauthorized Access Vulnerability
• New test for Node.js Inspector Unauthorized Access Vulnerability
• New test for Apache Shiro authentication bypass (CVE-2020-17523)
• New test for Reflected Cross-Site Scripting (XSS) vulnerability in PAN-OS management web interface (CVE-2020-2036)
• New test for Missing Authentication Check in SAP Solution Manager (CVE-2020-6207)
• New test for VMware vCenter Server Unauthorized Remote Code Execution (CVE-2021-21972)
• New test for Delve Debugger Unauthorized Access Vulnerability
• New check for HTTP response splitting with cloud storage
• New tests for WordPress plugins

Updates

• Acunetix updated to fully support NTLM Authentication for proxy authentication
• Multiple LSR/BLR and DeepScan updates and fixes
• Updated Chromium to v88.0.4298.0
• Updated Postgres database to v13.2
• Engines page has been updated to show the following:
  • Status (online or otherwise) for each Engine
  • The build number for each Engine
  • Any license issues are reported as part of the status for each Engine
• Multi-Engine setups will start to automatically update the Engine only installations when the Main installation is updated
• The UI will reload after Acunetix is upgraded
• ‘WAF Export’ button renamed to ‘Export to’, and feature added to the Scans Page
• Multiple updates to the Comprehensive report
• Proxy Settings can now be specified for each Issue Tracker
• Updated JavaScript Library Audit check to cover libraries not hosted on the scanned target
• Users can now be created from the API
• Updated CORS check

Fixes

• Fixed bug in “Vulnerabilities in SharePoint could allow elevation of privilege” check
• Fixed issue causing check for updates to occasionally fail on MacOS
• Fixed issue causing DOM XSS sink to not always be show the in the code extract displayed in the alert
• Fixed issue caused when a custom collection is used in a TFS issue tracker configuration
• Fixed issue in WordPress XML-RPC pingback abuse check
• Fixed Deepscan crash
• Fixed False Positive in Broken Link Hijacking check
• Vulnerability CSV export now includes URL where vulnerability was detected

Fixes

• Fix Backend issue related to AcuSensor

New Features

• Big improvement in handling of CSRF tokens
• Added support for ShadowRoot
• Added support for MacOS Big Sur

New Vulnerability Checks

• New test for Zabbix authentication bypass / guest user
• New test for Typo3 Admin publicly accessible
• New test for Typo3 debug mode enabled
• New test for Oracle WebLogic Remote Code Execution via IIOP
• New test for Web Cache Poisoning DoS
• New test for client-side prototype pollution
• Improved web cache poisoning test
• New test for SAP IGS XXE (CVE-2018-2392, CVE-2018-2393)
• New test for Odoo LFI (CVE-2019-14322)
• New test for Unrestricted access to Odoo DB manager
• New test for Apache Unomi MVEL RCE (CVE-2020-13942)

Updates

• Updated the UI for the multi-engine system
• Multiple updates to the PHP AcuSensor
• Multiple updates to the Login Sequence Recorder
• Scanning engine updated to support using proxy server with NTLM Authentication

Fixes

• Fixed issue causing the browser to fail to launch on Kali
• Fixed issue causing AcuSensor not found message to not be displayed
• Fixed false positive in Zend Framework LFI via XXE
• Fixed false positive in Directory Traversal
• Fixed false positive in Cookie(s) with missing, inconsistent, or contradictory properties
• Fixed false positive in Apache Struts2 Remote Command Execution (S2-052)
• Fixed issue in highlighting of vulnerability in response
• Fixed issue with Slow Loris
• Fixed issue in WADL importer
• Fixed crash in scanner
• Fixed minor issues in Comprehensive Report
• Fixed issue causing Acunetix to lose license information

Updates

• Updated Telerik vulnerability checks
• The Tech Admin user role can now create new Targets
• Renamed acu_phpaspect.php to acusensor.php
• Updated Comprehensive report to indicate Verified vulnerabilities
• Logon Banner now supports multi-line banners

Fixes

• Fixed issue in SlowLoris vulnerability check
• Fixed issue LSR hang caused when closing the LSR immediately after opening it
• Fixed scan hanging issue
• Fixed a couple of issues in the CSV export
• Fixed issue causing incorrect threat level in Comprehensive report
• Fixed false positives in Outdated JS libraries and Insecure Referrer Policy checks
• Fixed UI issue with long target name causing buttons to be hidden
• Fixed issue causing double input schemes
• Fixed crash in scanner
• Fixed issue causing vulnerability count in Dashboard to not always be updated

New Features

• Export Scans to JSON (available as WAF Export option)
• Added context-sensitive help for all pages in the UI. Clicking on the ? icon will open documentation for the specific page

New Vulnerability Checks

• New test for Apache OFBiz XMLRPC Deserialization RCE (CVE-2020-9496)
• New test for No HTTP Redirection
• Numerous tests related to TLS / SSL, including:
  • Added support for 200 new cipher suites, bringing the total number of supported cipher suites to 360
  • New test for TLS/SSL Diffie-Hellman Key Reuse (prerequisite for Raccoon Attack)
  • New test for TLS/SSL LOGJAM attack (CVE-2015-4000)
  • New test for TLS/SSL Sweet32 attack (CVE-2016-2183 and CVE-2016-6329
  • Alert if server offers cipher suites with symmetric encryption key length <128
  • Alert if server offers cipher suites using symmetric encryption algorithms RC2, DES (insecure), IDEA
  • Alert if server offers cipher suites using ANON, NULL, SHA-1 for authentication
  • Alert if server offers cipher suites using MD5 for HMAC
• New vulnerability checks for WordPress plugins and Drupal core

Updates

• Numerous updates to the UI
• Malware scan profile updated to check for Trojans
• Scanner updated to receive newly discovered hosts from vulnerability checks
• Updated Swagger 2 implementation to better cater for nested schemes/objects
• Updated deduplication to better cater for network scans / vulnerabilities
• Adaptive ciphersuite testing, reduces the average SSL/TLS scan duration by 90%

Fixes

• Fixed issue where no data was shown for archived scans
• Fixed some minor issues with default filters
• Fixed issue showing wrong Target count in license page
• Fixed UI issue affecting Custom Scan Profiles
• Fixed Possible Sensitive Files / Folders to use the Case Sensitive Paths setting for the Target
• Fixed issue in Reverse Proxy Detection check