I released Vulristics 1.0.11: added Server-Side Request Forgery (SSRF) as a distinct vulnerability type. I try to use a very small set of base vulnerability types (around 20) in Vulristics and map everything else to them. With a few exceptions, these are the same types Microsoft uses – and Microsoft doesn’t like SSRF.

SSRF is a vulnerability that allows an attacker to make network requests to arbitrary destinations.

Microsoft usually classifies SSRFs as EoP, Information Disclosure, or RCE. 🤯

I used to map SSRF to Command Injection, based on the logic that crafting a request can be considered a form of command execution. But, of course, that’s… questionable. 🙄

So I decided to add a dedicated SSRF type (with a severity of 0.87) and stopped doing mental gymnastics. 🙂 For the icon, I drew an anvil (a play on words with “forge”). I also uploaded the icon to avleonov.com so that Vulristics HTML reports render correctly.

На русском