Vulnerability · Published Apr 19, 2022 · Assigned by GitHub_M
CVE-2022-24825Smokescreen SSRF via deny list bypass
Medium 5.8
In plain English
A medium-severity server-side request forgery in smokescreen from stripe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by appending a dot to the end of user-supplied URLs, or by providing input in a different letter case. Recommended to upgrade Smokescreen to version 0.0.3 or later.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/stripe/smokescreen | 0.0.3 | GHSA-gcj7-j438-hjj2 |
| Go | github.com/stripe/smokescreen | 0.0.3 | GO-2022-0429 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| stripe | smokescreen | < 0.0.3 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/stripe/smokescreen/security/advisories/GHSA-gcj7-j438-hjj2 x_refsource_CONFIRM
- https://github.com/stripe/smokescreen x_refsource_MISC