I released Vulristics 1.0.11: added Server-Side Request Forgery (SSRF) as a distinct vulnerability type. I try to use a very small set of base vulnerability types (around 20) in Vulristics and map everything else to them. With a few exceptions, these are the same types Microsoft uses – and Microsoft doesn’t like SSRF.
SSRF is a vulnerability that allows an attacker to make network requests to arbitrary destinations.
Microsoft usually classifies SSRFs as EoP, Information Disclosure, or RCE. 🤯
I used to map SSRF to Command Injection, based on the logic that crafting a request can be considered a form of command execution. But, of course, that’s… questionable. 🙄
So I decided to add a dedicated SSRF type (with a severity of 0.87) and stopped doing mental gymnastics. 🙂 For the icon, I drew an anvil (a play on words with “forge”). I also uploaded the icon to avleonov.com so that Vulristics HTML reports render correctly.
Hi! My name is Alexander and I am a Vulnerability Management specialist. You can read more about me here. Currently, the best way to follow me is my Telegram channel @avleonovcom. I update it more often than this site. If you haven’t used Telegram yet, give it a try. It’s great. You can discuss my posts or ask questions at @avleonovchat.
А всех русскоязычных я приглашаю в ещё один телеграмм канал @avleonovrus, первым делом теперь пишу туда.