Invicti Standard

Improvements

• Added new paths to forced browsing
• Updated the vulnerability template for the Internal Server Error vulnerability
• Improved Insecure HTTP Usage detection

New Security Checks

• Added detection of Google Tag Manager as a technology in the Vulnerability Database (VDB)

Improvements

• Invicti Standard Agent upgraded to .NET 8 for improved performance and compatibility
• Improved analysis and remediation capabilities for [Possible] Server-Side Template Injection vulnerabilities

Fixes

• Fixed a missing proxy implementation for ICBD and Puppeteer
• Fixed an issue where Retest-type scans did not identify the same vulnerabilities detected during full scans
• Fixed high CPU usage in some agents caused by Chromium
• Fixed an issue where the Misconfigured Access-Control-Allow-Origin Header vulnerability was not detected
• Removed the [Possible] Password Transmitted over Query String vulnerability

Improvements

• Multiple .proto files can now be used for scanning gRPC API Web Services

Fixes

• Fixed an issue where uploading a .proto file caused a “No links found in the file” error
• Fixed missing request/response details for some out-of-band vulnerabilities

New Security Checks

• Added detection for multiple JavaScript libraries
• Added detection for Masa CMS (CVE-2022-47002 and CVE-2021-42183)

Fixes

• Fixed a bug that was disabling the skip scan phase option

New Security Checks

• Updated detection for ActiveMQ – Remote Code Execution (CVE-2023-46604) and TorchServe Management API SSRF (CVE-2023-43654)

Improvements

• Added ‘save as new’ and ‘overwrite’ options when importing scans
• Reporting improvements for the “Unknown Option Used In Referrer-Policy” vulnerability
• Added the ability to export/import scan profiles and scan policies between different instances of Invicti Standard

Fixes

• Various fixes for the verifiers
• Out-of-date version for Boolean Based MongoDB Injection is now reported correctly

New Security Checks

• Added XWiki version disclosure vulnerability and attack patterns.

Fixes

• Fixed the false negative issue related to Polyfill.io.
• Fixed an issue related to creating a custom script for a web application using the OIDC method with a login pop-up.

New Security Checks

• Adjusted the severity of SSLv3 and TLS 1.0 vulnerabilities to reflect their security risks
• Added support for CSP frame-ancestors
• Added detection for CVE-2024-6297, affecting several WordPress plugins

Improvements

• Pre-request script now works in DOM as well

Fixes

• Resolved an issue with a pre-request script that was affecting crawling functionality

New Security Checks

• Added detection for Jenkins Secret as a Sensitive Data Exposure

Improvements

• Started to utilize the Microsoft Azure Trusted Signing service for code signing of Invicti Standard

Fixes

• Fixed chromium-related issues in the agent
• Fixed the issue where temp folders could not be deleted and Chromium instances remained open when Puppeteer encountered an error
• Fixed the false positive on detection of “Stack Trace Disclosure (Java)”
• Fixed an issue related to the Moment.js regex
• Fixed the OIDC authentication issue
• Fixed the issue where the REST API endpoint returned HTTP 400 instead of HTTP 200 when sending custom values
• Fixed the issue preventing proper login to the target URL

New Security Checks

• Incorporated the reporting of sensitive information disclosures from Okta
• Added a check for Authentication bypass in Fortra’s GoAnywhere MFT (CVE-2024-0204)
• Added a check for Open SSH server RC (CVE-2024-6387)
• Added a check for cached pages that contain sensitive data (CWE-525)

Improvements

• Resolved an issue where scans were failing due to the TLS connection not being established

Fixes

• Resolved a problem that was causing scans to become stuck

Improvements

• Disabled the detection of CSRF vulnerabilities from built-in policies
• Added custom header support for SSRF registration

Fixes

• Fixed an issue related to BLR links

New Security Checks

• Added a new security check to identify supply chain attacks through Polyfill JS
• Added a detection for GeoServer SQLi vulnerability (CVE-2023-25157)
• Added checks for various WordPress plugins

Improvements

• Improved Credit Card Disclosure Security Check
• Added custom headers for communication between Agents and Invicti Hawk
• Set the severity of ‘Possible XSS’ vulnerabilities to ‘Informational’
• Improved various Sensitive Data Exposure security checks
• Improved the detection of the Short SSL Key Length vulnerability
• Added the capability to check for Sensitive Data in XML responses

Fixes

• Fixed missing Request Body content in vulnerability details
• Fixed an issue with the ‘IgnoreCertificateErrors’ Agent setting for SSL Validation
• Fixed a problem in the JWT Engine to resolve a false positive issue
• Fixed an issue related to the OTA app scan
• Fixed HTTP 413 responses resulting from nonce cookies stacking

New Features

• Added functionality for scanning gRPC API Web Services → Learn more

New Security Checks

• Added a new attack pattern for missing Open Redirection

Improvements

• Added an option to trigger only specified lists of events
• Updated all the IAST Sensors:
  • .NET Framework and .NET Core 6.2.0
  • Java 16.0.0
  • Node.js 2.1.3
  • PHP 8.0.1

Fixes

• Fixed an issue with user-agent selection in scan policies that was causing disabled security check vulnerabilities to appear in the dashboards and scan reports
• Fixed an issue with user-agent selection in scan policies that was causing disabled security check vulnerabilities to appear in the dashboards and scan reports
• Fixed vulnerabilities with the Invicti Scan Agent Docker image
• Fixed the disk space utilization issue that was causing the InvictiCommon folder size to increase significantly during scans
• Improved the crawling capability to allow for automatic crawling of XHR requests
• Fixed an AWS4Signer authentication issue