Invicti Enterprise On-Demand

This update includes changes to Internal Agents.

FEATURE

• Added Authentication Verifier for Internal Agents.
• Added State filter to notifications which you can use issue states like Fixed, Revived, New, etc. as filtering options.

IMPROVEMENT

• Removed the scan report selection from notification events that do not produce any reports.
• Added account-based option to display authentication credentials on API responses.

FIXES

• Fixed an issue where the Launch button does not get enabled on the New Scan page after you enable the IAST scanning and download the sensor files.
• Fixed an issue where a notification that is sent to an external email address was not displayed on the audit logs.
• Fixed an issue where starting a PCI scan via using API could not start the scan.
• Fixed an issue where a new notification created via API does not add the specified integration(s) to the new notification.
• Fixed an issue where a team member was not created in API if the auto-generated password is enabled.
• [INTERNAL AGENT] Fixed an issue where the custom value of FormAuthPageLoadTimeout was being overridden by its default value.

FEATURE

• Added support for creating Teams and Roles.
• Added SCIM 2.0 API support for improved SSO integration which supports user and group synchronization with popular Identity Providers

IMPROVEMENT

• Improved access control by introducing new more granular permissions
• Improved role assignment for website groups while inviting new members

This update includes changes to the internal agents. The internal scan agent's current version is 2.0.2.157. The internal authentication verifier agent's current version is 2.0.2.157.

New features

• Added a feature to generate an excel report for vulnerabilities identified across a website group.
• Added an API parameter to choose among agent groups to launch an incremental scan. [API-only]
• Added an option to determine how long Invicti stores scan data.

Improvements

• Improved the ServiceNow Incident Management.
• Improved the Jira integration to export a vulnerability’s details to the Jira ticket.
• Improved the SSO to inform users about the expired SAML certificate.
• Added an explanation for the failed requests error.
• Added name variable support for Passive and Singular Custom Security Checks.

Fixes

• Fixed the Business Logic Recorder issue that prevents login when there is a custom script for the form authentication.
• Improved the creation of websites via the Discovery Service to include the port numbers and the URL.
• Fixed a bug that displayed vulnerabilities without their id on the website and global dashboard page.
• Fixed WSDL parse issue for non-defined object types.
• Fixed the null reference exception on HTTP Requester.
• Fixed the internal agent update issue that is stuck in the updating process.
• Fixed the deserialization problem when importing the scan session to Invicti Standard.

Removed

• Removed the .NET installation requirement for internal agents.

New security checks

• Added the check for Boolean-based MongoDB injection.
• Added the check for MongoDB Operator Injector.
• Implemented the XML external entity check for IAST.
• Added the ISO/IEC27001:2022 Classification.
• Added the report template and attack pattern to the Out-of-band RCE.
• Added passive check for Lua.
• Added a security check to detect public Docker files.
• Implemented a new engine to identify WordPress themes and Plugins.
• Added new security checks for SAML.
• Added security check for IT Hit WebDAV Server .Net Version Disclosure.
• Added security check for MS Exchange Version Disclosure.
• Added new payloads for Command Injection.
• Added support for PopperJS.
• Added support for CanvasJS.
• Added new security check for the SQLite Database Detection.
• Added new payloads for Header Injection.
• Added new security check for Spring Boot Actuator Detection.
• Added security check for NodeJS Stack Trace Disclosure.
• Added security check for SailsJS and ActionHero Identified.
• Added security check for JetBrains .idea Detected.
• Added security check for GraphQL Stack Trace Disclosure.
• Added security checks for Javascript Libraries.
• Added security checks for Web Application Fingerprinter Engine.
• Added new security checks for WordPress Hello Elementor Theme Detection.
• Added new security checks for WordPress Twenty Twenty-Three Theme Detection.
• Added new security checks for WordPress Twenty Twenty-Two Theme Detection.
• Added new security checks for WordPress Astra Theme Detection.
• Added new security checks for WordPress Twenty Twenty-One Theme Detection.
• Added new security checks for WordPress Twenty Twenty Theme Detection.
• Added new security checks for WordPress OceanWP Theme Detection.
• Added new security checks for WordPress Twenty Seventeen Theme Detection.
• Added new security checks for WordPress Kadence Theme Detection.
• Added new security checks for WordPress Twenty-Sixteen Theme Detection.
• Added new security checks for WordPress Twenty Nineteen Theme Detection.
• Added new security checks for WordPress PopularFX Theme Detection.
• Added new security checks for WordPress GeneratePress Theme Detection.
• Added new security checks for WordPress Inspiro Theme Detection.
• Added new security checks for WordPress Go Theme Detection.
• Added new security checks for WordPress Smash Balloon Social Photo Feed Plugin Detection.
• Added new security checks for WordPress Contact Form 7 Plugin Detection.
• Added new security checks for WordPress Yoast SEO Plugin Detection.
• Added new security checks for WordPress Elementor Website Builder Plugin Detection.
• Added new security checks for WordPress Classic Editor Plugin Detection.
• Added new security checks for WordPress Akismet Spam Protection Plugin Detection.
• Added new security checks for WordPress WooCommerce Plugin Detection.
• Added new security checks for WordPress Contact Form by WPForms Plugin Detection.
• Added new security checks for WordPress Really Simple SSL Plugin Detection.
• Added new security checks for WordPress Jetpack Plugin Detection.
• Added new security checks for WordPress All-in-One WP Migration Plugin Detection.
• Added new security checks for WordPress Wordfence Security Plugin Detection.
• Added new security checks for WordPress Yoast Duplicate Post Plugin Detection.
• Added new security checks for WordPress WordPress Importer Plugin Detection.
• Added new security checks for WordPress LiteSpeed Cache Plugin Detection.
• Added new security checks for WordPress UpdraftPlus WordPress Backup Plugin Plugin Detection.
• Added new security check for EZProxy Identified.

Improvements

• Improved the user interface for the website's menu for API.
• Improved the user interface for the crawling options on the New Scan page.
• Improved the business logic recorder to play the authenticated record.
• Updated the Signature Detection pattern.
• Improved the wordlist for Forced Browsing checks.
• Changed the Session Cookie not marked as Secure severity from High to Medium.
• Improved the performance of downloading the discovery data via the API endpoint.
• Increased the delay control for max scan duration to 12 hours. After 12 hours of the maximum scan time set by the customer, the web application fails the scan.
• Improved Drupal and Joomla detection.
• Improved the Next.js version detection.
• Improved Django debug mode enabled.
• Updated the SSL/TLS report template.

Fixes

• Improved report generation via API endpoints.
• Fixed the login failures when the Authentication Profile is selected as the Use matched profile.
• Fixed the issue that caused the flashing custom script screen.
• Fixed the issue with cascading combo box by fixing the query.
• Fixed an internal server error while exporting from the Invicti Standard to the Invicti Enterprise.
• Fixed the issue with the “#” sign that can appear in the target URL.
• Fixed the issue with choosing the All option from the website group drop-down on the Reporting page.
• Fixed an issue about HTTP Status codes on the crawler performance in the Knowledge Base Report.
• Fixed the importing GraphQL introspection issue.
• Fixed the weak Nonce detection in Content Security Policy.

This update includes changes to Internal Agents. The internal agent’s current version is 2.0.2.125.

IMPROVEMENTS

• Improved the Login Banner Warning feature so that users cannot access any resources on Invicti Enterprise until they select the Accept, Continue button.
• Add the Environment field to the DefectDojo integration.
• Added the Export to CSV button on the Manage Members page so that you can download all your team members to your environment.

FIXES

• Fixed a bug that prevented the scan profile of a deleted website from being removed. Now, when users delete a website, the related scans, including scan profile, are also deleted.
• Fixed an issue that prevent the scan from being canceled.
• Fixed the missing ScanTaskProfile field by adding it back to scan API call responses.
• Fixed a bug that prevents members and teams from being deleted if they have been assigned to website groups.
• Fixed a bug that allows the API member edit endpoint which accepts less than 15 characters for the administrator's password.
• Changed the permission to view reports from Add/Edit Scan to the View Report.
• [INTERNAL AGENTS] Changed Agent request time interval to 60 seconds.
• [INTERNAL AGENTS] Fixed a bug that prevents an agent from scanning a new website if the previous scan was canceled.

This update includes changes to the internal agents. The internal scan agent's current version is 2.0.2.145. The internal authentication verifier agent's current version is 2.0.2.145.

IMPROVEMENT

• Improved the scan agent to continue scanning in case of getting HTTP status errors like Forbidden, Unauthorized, and ProxyAuthenticationRequired for websites supporting TLS 1.3.

This update includes changes to internal scan agent. The internal scan agent's current version is 2.0.2.140.

NEW SECURITY CHECKS

• Added Remote Code Execution (CVE-2022-22965) a.k.a. Spring4Shell detection support.

New features

• Now you can enter multiple IP addresses and IP ranges into the IP Address Restrictions setting. Previously, only single-entry IP addresses were permitted. 
• Added TLS certificate authentication as an option when integrating with HashiCorp Vault. Previously, we only supported token authentications. 
• The default compression format for log files is now .tar instead of 7zip

Improvements

• Disabled caching from the boolean-based MongoDB security engine to avoid possible false positives
• Improved the content-type exemption for non-HTML content types in the CSP engine
• Improved the typehead.js check to increase stability 
• Removed the X-XSS-Protection header check because it is deprecated by modern browsers
• Added functionalities to prevent bot detection and fixed an issue that was causing cookie loss after authentication
• Improved the remediation part for the JetBrains .idea detected vulnerability

Fixes

• Fixed a bug that was stopping the certificate authentication process from working correctly for Authverifiers
• Fixed a boolean-based MongoDB Injection that was causing false positives in scan reports
• Fixed the incorrect display of vulnerabilities when importing scan results from Invicti Standard to Invicti Enterprise
• Fixed a bug that was preventing the editing of internal website URLs
• Fixed the character validity issue so that user names with Danish characters can now be edited in the UI
• Fixed a bug that was allowing access to the UI via the back button after the user had signed out
• Fixed the Discovery Main Domains Filter Expression that was not working properly for some domains
• Fixed an issue that was causing tags to be duplicated when a website was imported using a CSV file
• Fixed the update agent command that was not working correctly
• Fixed the internal Linux v23.7 AV agent that wasn’t sending header configurations
• Encrypted the proxy password used in the scan policy file
• Fixed a scan coverage issue
• Fixed the external SOAP web service import problem
• Fixed a custom script issue so that now passwords written to the logs are encrypted
• Fixed an issue where vulnerabilities could not be generated as CloudFlare WAF rules via API
• Fixed a problem that was causing default values to be filled incorrectly, resulting in false negatives

This update includes changes to Internal Agents.

IMPROVEMENTS

• Prevented deletion of system notifications.
• Forced Browsing wordlist made editable.
• Added tooltips displaying the full issue title on the Issues tree when the titles are clipped due to length.

FIXES

• Fixed /notifications/ update API endpoint which was not updating recipient emails before.
• Fixed a Scan Policy Optimizer issue where the Resource Finder settings are not captured when the selection tree is collapsed.
• Fixed an issue where the Custom Script cannot be created when 3-Legged Authentication is selected while configuring OAuth2.
• Fixed an issue where the ISO Compliance report cannot be exported for some of the scans.
• [INTERNAL AGENT] Fixed runtime exceptions thrown on systems that are missing ClamAV.

This update includes changes to the internal agents. The internal scan agent's current version is 2.0.2.151. The internal authentication verifier agent's current version is 2.0.2.151.

IMPROVEMENTS

• [Early Access] Improved the scan profile feature, so any updates on a scan profile are to be reflected on the scheduled scans, incremental scans, and retests.
• Improved the Activity Log page to list any changes on the general settings.
• Improved the user agent to add custom user agents.
• Improved the Basic, Digest, NTLM/Kerberos, Negotiate Authentication to inform users on test credentials page whether this authentication is required or not.
• Improved the required information for the Kafka integration.
• Improved the raw scan file expired information message.

FIXES

• Fixed a bug that does not show the status change drop-down on the scan report page when zoomed in.
• Updated the Unfuddle Integration where optional fields have "required" text.
• Improved the IP Restriction Infrastructure.
• Fixed failed scans where the Target URL is IPv6 and starting with ::1
• Fixed the null reference problem issue while using the 3-legged flow type for OAuth2.
• Fixed the Chrome version number on the custom script editor while using an internal authentication agent.
• Fixed the GraphQL retest bug that showed a different request count.

Improvements

• Improved notification delivery with integration services
• [Closed Beta] Protected visibility of passwords within custom scripts

Fixes

• Fixed Vulnerabilities visible from UI but not via API in certain failed scan situations
• Fixed inconsistent Scan State in rare Deleted Scan scenario
• Fixed missing Next Execution Time for certain scheduled scans
• Fixed cannot save scheduled scans in some scenarios
• Fixed inconsistencies in the Resource Finder with certain hidden files and backup files
• Fixed improved updating of groups in Azure Provisioning scenario
• Fixed cannot convert scan data while CloudProvider Settings page is open
• Fixed database update exception with a large number of simultaneous scans launched

This update includes changes to the internal agents. The internal scan agent’s current version is 2.0.2.160. The internal authentication verifier agent’s current version is 2.0.2.160.

Improvements

• Improved the Technologies page for detailed version information of technologies identified.
• Improved the target website deletion process to prevent any errors because of instantaneous action.
• Add a new API endpoint (api/1.0/issues/summary) for better issue reporting.
• Improved the maximum scan duration to stop only those scans with the Scanning status.
• Added default SSL Configuration to docker agents.
• Added a token matching rule when it is required to get the token from a website other than the target URL.

Fixes

• Fixed the scanner agent issue where the Linux agents failed because of TLS as a result of breaking changes in .NET 5.
• Fixed the basic authentication issue that threw an error although the credentials are correct in the scan profile.
• Fixed the business logic recorder issue that prevented the recorder to play recorded steps during a scan.
• Fixed the inconsistent number of vulnerability counts by severity information on the scan report page.
• Fixed the vulnerability serialization issue that caused the out-of-memory error.
• Fixed the scan scope issue that does not load the scan scope correctly on the first try.
• Fixed the scan profile issue that failed to register the database selected on the scan optimization page.
• Fixed the corrupted scan data ZIP file downloaded via an API endpoint.