Acunetix Standard & Premium

New Features

• Acunetix is now available in Simplified Chinese
• Path Fragments are now shown in the site structure

New Vulnerability Checks

• New check for Insecure Inline Frames
• New check for Remote code execution of user-provided local names in Rails
• New check for SAP NetWeaver RECON auth bypass vulnerability
• New check for H2 console publicly accessible
• New check for PHP version disclosure
• New check for Atlassian JIRA ServiceDesk misconfiguration
• New test for Jolokia XML External Entity (XXE) vulnerability
• New checks for WordPress core, WordPress themes, WordPress plugins, Joomla and Drupal

Updates

• Created and Last Updated dates are available for vulnerabilities
• Order of section in Comparison report updated to be more intuitive
• Target Address is shown in full in the UI
• /users/ endpoint is now available in the API

Fixes

• Fixed issue when exporting vulnerabilities to WAF which contained CVSS3.1
• Fixed issue causing custom user-agent to not be used in all requests during a scan
• Fixed issues causing some vulnerabilities not to be well formatted when sent to JIRA issue tracker
• Fixed issue when adding JIRA Issue Tracker in Acunetix Online
• Fixed issue caused when adding Targets to an existing Target Group
• Minor fix in Comprehensive report text
• Fixed UI issue showing blank list (Scans, Targets etc) when using the browser’s back button
• Fixed issue caused by scanning Targets with complex GraphQL schemas

New Features

• Introduced support for GraphQL
• Introduced support for OAuth2.0
• GraphQL files can be used as Import Files
• New Comprehensive Report, which includes the HTTP Response in the HTML version of the report
• HTTP Response uses syntax highlighting for improved readability
• Scans can now be restricted to paths/locations in import files
• User can choose which columns to show in all the Acunetix lists
• UI saves columns selected for each page / user (applies to Targets, Vulnerabilities, Scans and Reports)
• UI saves number of items to show on each page / user (applies to Targets, Vulnerabilities, Scans and Reports)
• UI saves sorting order for each page / user (applies to Targets, Vulnerabilities, Scans and Reports)

New Vulnerability Checks

• New check for vBulletin 5.6.1 (and earlier) nodeId SQL injection
• New check for Cmd hijack vulnerability
• New check for PHP opcache-gui publicly accessible
• New check for Laravel debug mode enabled
• New check for Laravel Health Monitor publicly accessible
• New check for Laravel Health Horizon publicly accessible
• New check for Laravel Health LogViewer publicly accessible
• New check for Laravel Health Telescope publicly accessible
• New check for Laravel Ignition Reflected Cross-Site Scripting
• New check for Laravel framework weak secret key
• New check for HTML Attribute Injection
• New check for Clockwork PHP dev tool enabled
• New check for PHP Debug Bar enabled
• New check for Broken Link Hijacking
• New checks for Cookie misconfigurations leading to security issues
• New vulnerabilities for WordPress Core, WordPress plugins, Joomla and Drupal

Updates

• Targets with Manual Intervention cannot have a Business Logic Recording
• Changed vulnerability name filter to use search as you type
• Scans will start reporting pages that require HTTP Authentication
• Acunetix UI notifications have been changed as follows:
  • Moved to bottom right of Acunetix UI
  • Stay longer on the page
  • Can be closed by the user
• Increased name length limit of import files to 128 characters
• User can optionally specify the address to be used for Auto-login. This is useful for SSO login pages
• The scanner will try to connect to the address of the target before aborting the scan after 25 consecutive network errors
• Targets can be deleted and replaced on the license anniversary

Fixes

• Fixed: The vulnerability name filter did not always show all vulnerabilities
• Fixed incorrect error handling message when disabling the proxy settings
• Hide Business Logic Recorder for Network Only targets
• Fixed: Acunetix Online was showing an ID as the name of some network vulnerabilities
• Fixed: Acunetix Online was not always showing the HTTP Response for some vulnerabilities
• Fixed: Acunetix Online was not showing the number of licensed Targets
• Fixed issue causing paths of ignored files to be ignored too
• Fixed LSR issue on Safari browser
• Fixed issue caused when the LSR and BLR are used on certain sites
• Various minor fixes to the UI
• Fixed false positives in over 25 vulnerability checks

New Features

• Business Logic Recorder – used to record logic used in multi-step forms
• Export to Citrix WAF
• Support for Azure DevOps Services issue tracker
• CVSS3.1 score for most Acunetix vulnerabilities
• Targets can now be exported to CSV
• New Graph in Dashboard showing Average vulnerabilities per Target

New Vulnerability Checks

• New check for Server-Side Template Injection (SSTI) in ASP.NET Razor
• New check for Oracle BI AMF Deserialization RCE (CVE-2020-2950)
• New check for Possible Cross Site Scripting via jquery.htmlPrefilter() (CVE-2020-11023)
• New check for Stored XSS in WP theme Onetone (CVE-2019-17230 and CVE-2019-17231)
• Updated detection of phpinfo pages
• New checks in WordPress Core and WordPress plugins
• New checks for default credentials in over 65 web applications

Updates

• Manual Intervention (used for CAPTCHAs, OTP etc) is now using the integrated (web-based) LSR
• As a result of the previous update, Manual Intervention is now available on Linux
• Improved error reporting for network scans aborted due to network errors
• Vulnerability alerts updated to show important information at the top
• Updated Github issue tracker to support Personal Access Token (PAT) authentication
• Improved reporting of Paused scans in the UI
• Improved UI message user triggers a scan which is not allowed due to Manual Intervention
• API documentation can now be downloaded from within the Acunetix UI
• Added support for popup windows in the Login Sequence Recorder
• Improved handling of large import files
• Improved handling large requests / responses generated from import files
• Decreased false positives reported for Possible username or password disclosure
• Truncated large vulnerability alerts when sending to Jira issue tracker

Fixes

• Fixed incorrect from email address used for monthly update emails
• Fixed AcuMonitor UI notification to link to corresponding vulnerability
• Fixed issue causing vulnerability checks to not be able to send empty values
• Fixed a number of crashes
• Fixed issue causing ASP.NET sites to be processed as ASP sites
• Fixed 2 issues caused when using Swagger import files
• Improved handling of txt import files using incorrect import format
• Fixed Session Fixation false positive
• Fixed UI issue when configuring Custom Cookies
• Trend charts where not being updated for user accounts
• Fixed issue in excluded hours
• Fixed “Client Certificate Not Set” message incorrectly being reported

New Vulnerability Checks

• New WordPress plugin checks

Updates

• Improved XXE check
• Improved internal IP disclosure check
• Vulnerabilities detected with 100% Confidence get a Verified stamp

Fixes

• Fixed issue with response highlighting for SQL Injection alerts
• Fixed AcuMonitor alert notifications not linking to scan
• Fixed page not found UI issue when trying to generate a report from Reports page
• Fixed issue with scanner looping when parsing specific long JSON responses

New Features

• New Acunetix web UI
• Improved Network Scanner integration
• Malware Detection using Windows Defender on Windows and ClamAv on Linux
• Smart Scan
• New scanning algorithm prioritises scanning tasks and reduces scanning time
• Proof of exploit is reported in the vulnerability alerts
• Incremental Scans
• Vulnerability Confidence Rating for web vulnerabilities
• New GitLab Issue Tracker Integration
• New Bugzilla Issue Tracker Integration
• New Mantis Issue Tracker Integration
• Ability to create Login Sequence from Selenium script
• New WADL import file
• New ASP.NET Webforms import file
• New Postman import file
• New Paros import file
• Ability to create custom checks
• Highlighting of vulnerability in HTTP response
• DeepScan provides better support for Angular 2, Vue and React JavaScript Frameworks
• Unlimited network scanning for Acunetix Premium customers
• Account Session Timeout settings
• Account Maximum Consecutive Login Failure settings

New Vulnerability Checks

• New check for publicly accessible Bitrix server test script
• New check for publicly accessible NGINX+ dashboard
• New check for unrestricted access to NGINX+ API endpoints
• New check for outdated TLS version
• New check for Citrix Netscaler Unauthenticated Remote Code Execution (CVE-2019-19781)
• New check for Kentico CMS Deserialization RCE
• New check for Cross site scripting via Bootstrap
• New check for Django weak secret key
• New check for Oracle Weblogic T3 XXE (CVE-2019-2888)
• New check for leakage of API keys
• New check for JWT weak secret key
• New check for JWT none algorithm
• New check for publicly exposed .NET HTTP Remoting
• New check for .NET BinaryFormatter Object Deseralization vulnerabilities
• New check for Apache Solr Parameter Injection
• New check for Ruby framework weak secret key
• New check for Tornado weak secret key
• New check for BottlePy weak secret key
• New WordPress Core and plugin vulnerability checks
• New Joomla Core vulnerability checks
• New Drupal Core vulnerability checks

Updates

• Improved memory consumption for the scanner
• PDF reports now have page numbers
• Generic User-agent will be used for communication with issue trackers
• All lists in Acunetix UI can be sorted
• Easier filtering options in the Acunetix UI
• Settings can now be accessed from the side-bar
• Links discovered by AcuSensor are given more prominence
• Improved processing of XML and JSON POST input schemes
• Scanner will try to replay the LSR playback actions a number of times before failing
• Improved Auto-Login
• Multiple updates in the Login Sequence Recorder
• Developer report updated to include Source file, line number and other details provided by AcuSensor
• Acunetix now supports scanning domains with international characters
• Increase page size limit to 20Mb in scanner and LSR
• Improved detection of Possible Sensitive Files
• Improved detection of email addresses
• Improved detection of Command Injection
• Improved detection of database backup files
• Improved detection of XXE

Fixes

• Fixed issue in Developer report showing incorrect parameter name for detected vulnerabilities
• Fixed: “Tester” user role will not be able to create reports
• upgrades on Linux were not removing all files from previous installation
• Fixed issue with Manual Intervention
• Fixed: Session cookies where not always collected by LSR
• Fixed: Incorrect processing of URLs with “{” character
• Fixed a number of crashes in scanner
• Fixed issue causing scanner proxy to unintentionally transform parts of the HTTP request
• Fixed false positive in the detection of Apache Tomcat Remote Code Execution
• Fixed issues causing some links not to be properly imported by the importer
• Fixed issue with license activation when proxy and authentication is used
• Fixed issue causing session to get lost when Deepscan is used