gitlab-org/security-products/dast v3.0.28

on GitLab

Changes

• Upgrade browserker to version 0.0.107 (!651)
  • Active checks find injection locations in all crawled HTTP messages browserker!840
  • Upgrade vulnerability checks to version 1.0.48 browserker!853
    • Update expressions for 78.1 dast-cwe-checks!184
    • Convert double brackets {{...}} to single brackets {...} for consistency dast-cwe-checks!185
    • Fix broken matching regular expressions for check 22.1 dast-cwe-checks!186
  • Upgrade vulnerability checks to version 1.0.49 browserker!853
    • Update etc/passwd expression for 22.1 dast-cwe-checks!187
  • Upgrade vulnerability checks to version 1.0.50 browserker!853
    • Add 943.1 Improper Neutralization of Special Elements in Data Query Logic MongoDB dast-cwe-checks!166
    • Check 94.4 is resilient to mirrors being used as the source URL dast-cwe-checks!188
    • Check 94.4 uses self-executing functions to maximize likelihood of execution when injected into eval dast-cwe-checks!188
  • HTTP messages loaded for active checks are cached for fast retrieval browserker!855
  • Enable active check 94.4 browserker!839
  • Ignore callback attacks when parsing active check definitions browserker!839
  • Log which injection location detector failed when there is an error browserker!854
• Enable browser-based active check 78.1 OS Command Injection (!651)
• Enable browser-based active check 94.4 Server-side code injection (NodeJS) (!651)

Docker Images

• registry.gitlab.com/security-products/dast:3.0.28