Acunetix Standard & Premium

New Vulnerability Checks

• New check to warn user if server sends known password to client
• New check for RCE in Liferay Portal (CVE-2020-7961)

Updates

• Improved detection of SQL Injection

Fixes

• Fixed bbcode display issue in some alerts
• Fix in Login page password-guessing attack
• Fixed licensing issue caused by different case in Target address

New Features

• Introduced support for processing of Swagger 2.0 files during scans
• Introduced support for Swagger 2.0 files as import files
• New Quarterly scheduled scan option
• Users can change their password from the Acunetix UI

New Vulnerability Checks

• New check for Weak key used to sign cookie in Play framework
• JavaScript Library Audit now supports TinyMCE
• New check for BigIP iRule command injection
• New check for XSS in .NET session in URL
• New check for Remote Code Execution (RCE) in Ruby on Rails (CVE-2019-5420)
• New Check for Oracle E-Business Suite Deserialisation RCE
• New Check for Oracle E-Business Suite SSRF (CVE-2017-10246)
• New Check for Oracle E-Business Suite SSRF (CVE-2018-3167)
• New Check for Oracle E-Business Suite SQL Injection (CVE-2017-3549)
• New checks for WordPress Core and plugins, Joomla and Drupal

Updates

• Minor UI updates
• Better reporting of scans interrupted due to network errors
• Client Certificate address can now be configured for a Target
• HTTP Authentication address can now be configured for a Target
• Abort Scan after 25 network errors
• Implemented Proof of Exploit for Blind SQL Injection vulnerabilities
• Improved showing Scan Duration for long scans
• Acunetix can be installed in custom paths
• Scan email notifications will include a PDF report if requested at start of scan
• Email notifications can be configured for:
  • Product updates
  • Target notifications
  • Scan notifications
  • Report notifications
  • Monthly status updates

Fixes

• Fixed: On Reports page, Target address shows as N/A for Targets that do not have a Description
• Fixed issue uploading import files larger than 1mb
• Fixed issue whereby some addresses had missing a character in the report
• Fixed false positive in Possible server path disclosure
• Fixed issue causing the scanner to not following multiple redirects
• Fixed 2 scanner crashes
• Multiple fixes in WADL parser
• Fixed: Case Sensitive Paths settings was sometimes not being taken into consideration
• Fixed issue in Possible Sensitive Directories identifying incorrect locations
• Fixed issue for users with expired passwords not given the option to change their password

New Features

• New scanning algorithm resulting in faster scans
• Scanner will give higher priority to locations which are dissimilar to ones that have already been scanned
• JAVA AcuSensor now supports JAVA Spring Framework

New Vulnerability Checks

• New check for Ruby on Rails Code Injection
• New check for Perl Code Injection
• AcuMonitor can now detect OOB PHP evaluation of user input
• New check for Prototype Pollution
• New check for Blind XSS via CSP report-uri
• New check for Jira Unauthorized SSRF via REST API
• New check for Apache Tapestry weak secret key
• New check for Oracle PeopleSoft SSO weak secret key
• New check for Yii2 weak secret key
• New check for Web2py weak secret key
• New check for Golang runtime profiling data
• New check for Adminer 4.6.2 file disclosure vulnerability
• New check for Apache mod_rewrite open redirect (CVE-2019-10098)
• New check for Flask weak secret key
• New check for Express express-session weak secret key
• New check for vBulletin 5.x 0day pre-auth RCE
• New check for Argument Injection

Updates

• Deepscan is now caching static assets. This will result in faster scans
• Improved memory consumption by the scanner
• Improved processing of forms and form handling
• Improved detection of paths
• Scanner will now process commented out html
• Updated command injection payloads

Fixes

• Fixed scanner crash
• Fixed WAF detection false positive
• Fixed: Check for Sensitive files was accessing restricted links
• Fixed issue causing scanner to multi-line session validation pattern
• Fixed: Some locations where incorrectly detected by DeepScan
• Fixed issue causing integrated LSR to close due to Ad blocking
• Fixed issue with HAR import files
• Fixed issue in the detection of Weak authentication credentials
• Fixed issue affecting the detection of DOM XSS vulnerabilities
• Fixed issue in the detection of possible username and password disclosure
• Fixed issue with recording restricted links in Internet Explorer
• Fixed: Tech Admin can now configure the engine to be used for a Target
• Fixed issue affecting scanning of domains with international characters

New Features

• Implemented support for OpenSearch
• Acunetix will try to discover hidden parameters and test them
• Acunetix can now check base64 encoded JSON inputs for vulnerabilities

New Vulnerability Checks

• New test for Oracle Business Intelligence Convert XXE (CVE-2019-2767)
• New test for Oracle Business Intelligence Adfresource Path traversal (CVE-2019-2588)
• New test for Oracle Business Intelligence AuthBypass (CVE-2019-2768)
• New test for Oracle Business Intelligence ReportTemplateService XXE (CVE-2019-2616)
• New test for Jira RCE (CVE-2019-11581)
• New test for Test for Atlassian Crowd RCE (CVE-2019-11580)
• New tests for Python Code Injection
• New test for Apache Spark RCE [https://spark.apache.org/security.html] (CVE-2018-11770)
• New test for ColdFusion Deserialization RCE (CVE-2019-7091)
• Implemented support for OpenID Connect Discovery
• Detect and report Apple application association files
• Added new checks for WordPress plugins, Drupal core and Joomla core

Updates

• Updated UI to accept IPv6 addresses
• Multiple improvements to DeepScan
• Improved the Directory Traversal check
• Updated the scan limits, reducing repeated requests to larger sites
• Acunetix will now extract and process gzipped files
• Multiple updates to parsing and heuristic crawler features
• Improved the vulnerability deduplication – similar vulnerabilities will be reported once
• Improved reporting of the cause of scan failures (e.g. website is unresponsive, invalid import file etc)
• Credentials provided to Auto-Login or LSR will not be used for vulnerability tests
• Improved processing of Selenium scripts
• Improved login form detection by Auto-Login feature
• Improved WebLogic detection, and testing for default WebLogic credentials
• Improved detection of Vulnerable JavaScript libraries check

Fixes

• Fixed a number of issues causing the scanner to stop unexpectedly
• Fixed issue causing AcuMonitor checks to be done when AcuMonitor is not enabled
• Fixed issue with WSDL parsing
• Fixed: Reflected tests (e.g. reflected XSS) was not done on JSON inputs
• Fixed issue causing 100% CPU usage when processing certain pages
• Fixed hang in the Acunetix Administrative Password utility on Windows
• Fixed: DeepScan was not processing XHTML pages
• Fixed issue causing Chromiumn process to remain active after PDF report generation
• Fixed issue caused by background requests when recording a login sequence
• Fixed issue when recording a login sequence on a site that uses cross-domain iframes
• Fixed issue when parsing WADL
• Fixed issue causing Host Header Attack false negatives

New Features

• Network Scanning via OpenVAS integration
• Introduced support for IPv6 domains (IPv6 addresses not supported yet)
• Dynamic resource allocation for when multiple scanners are started on the same machine
• Improved resource usage for string comparison functions
• Selenium scripts can now be used as import files

New Vulnerability Checks

• NEW check for Memcached Unauthorized Access Vulnerability
• NEW check for Redis Unauthorized Access Vulnerability
• NEW check for SAP ICF /sap/public/info sensitive information disclosure
• NEW check for SAP NetWeaver server info information disclosure
• NEW check for SAP NetWeaver ConfigServlet remote command execution
• NEW check for SAP Portal directory traversal vulnerability
• NEW check for SAP NetWeaver ipcpricing server side request forgery
• NEW check for SAP Management Console list logfiles
• NEW check for SAP Management Console get user list
• NEW check for SAP NetWeaver server info information disclosure
• NEW check for SAP Knowledge Management and Collaboration (KMC) incorrect permissions
• NEW check for SAP NetWeaver Java AS WD_CHAT information disclosure vulnerability
• NEW check for SAP weak/predictable user credentials
• NEW check for OpenCms Solr XML External Entity (XXE) vulnerability
• NEW check for Confluence Widget Connector SSTI
• New check for Ruby source code disclosure
• NEW check for Python source code disclosure
• Added new WordPress Core and WordPress Plugins vulnerability checks
• Added new Drupal Core vulnerability checks
• Added new Joomla Core vulnerability checks

Updates

• Multiple improvements to the detection of Blind SQL Injection
• Improved the Error Messages vulnerability check
• Improved the Adobe Experience Manager tests
• Improved detection of Java Deserialization and Mongo alert deduplication
• Improved detection of Rails accept file content disclosure
• Updated alert details for Oracle WebLogic Remote Code Execution via T3 (CVE-2018-3245)
• Improved detection of Confluence
• Improved PHP AcuSensor when used on nginx
• Improved detection of PHP code injection
• Updated Directory Traversal Check to make fewer requests
• Multiple improvements to DeepScan and the LSR
• Implemented support for WebSockets in LSR and Deepscan

Fixes

• Fixed a few crashes
• Fixed issue causing Postcrawl scripts to not be executed on folders
• Fixed: Custom cookies could be used twice when the application sets the same cookies
• Cookie processing now ignores leading . in domain
• Fixed issue with LSR when used on Internet Explorer
• Fixed issue with HTTP Authentication
• Fixed false positive in Struts_RCE_S2-052_CVE-2017-9805
• Fixed severity level for CSRF vulnerability check
• Fixed False Negative in Mercurial repository found check
• Fixed issue causing site structure not to be updated with locations identified by vulnerability scripts