Syhunt Hybrid 6.9.15 adds Fastjson RCE vulnerability detection and more

Today we release Syhunt Hybrid 6.9.15.1 which adds the detection of the Fastjson RCE vulnerability (CVE-2022-25845) to the Syhunt Code tool. The remote code execution vulnerability affects versions 1.2.80 and older of Fastjson and is caused by the default AutoType restriction which can be bypassed under specific conditions. An attacker could exploit this critical vulnerability to perform remote code execution on the target machine.

For customers performing regular scans, the new release of Syhunt fixes a delay that occurred when loading the Past Sessions screen and when generating reports with comparison information.

Improvements in Version 6.9.15

• Added checks for the high severity Fastjson remote command execution vulnerability (CVE-2022-25845, CVSS score: 8.1) to Syhunt Code.
• Added additional alerts related to the Log4J vulnerabilities disclosed last year (CVE-2021-44832 and CVE-2021-45105) to Syhunt Code.
• Significantly faster Past Sessions loading.
• Added additional spider optimizations in Dynamic.
• Improved start URL handling in Dynamic (Angular applications).
• Run once option in Scheduler moved to the Advanced tab.
• Fixed: a false positive problem involving directory traversal and remote command execution and assets with input.
• Fixed: Long waiting when loading past sessions list when a large number of sessions has been archived.

Happy bug and breach hunting!