CVE-2022-24825: Smokescreen SSRF via deny list bypass
Summary
CVE-2022-24825: Smokescreen SSRF via deny list bypass. Affects github.com/stripe/smokescreen versions < 0.0.3. Fixed in 0.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Smokescreen is a Go package developed by Stripe that is primarily used to prevent server-side request forgery (SSRF) attacks. It helps protect applications from external attackers who attempt to connect to or scan internal infrastructure. Smokescreen offers a deny list feature to block access to additional URLs. However, a vulnerability in Smokescreen allows bypassing the deny list by appending a dot to the end of user-supplied URLs or providing input in a different letter case.
Vulnerability Detail
The vulnerability in Smokescreen allows an attacker to bypass the deny list feature, which is intended to block access to external URLs. By appending a dot to the end of a user-supplied URL or providing input in a different letter case, an attacker can evade the deny list and potentially access restricted resources. This vulnerability can be exploited to perform unauthorized actions or gain unauthorized access to internal infrastructure. The severity of this vulnerability is moderate, with a CVSS score of 5.8.
How To Fix
Latest published version: v0.1.0 as of 23 Oct 2026
go get github.com/stripe/smokescreen@v0.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.3
This is the first release that contains the fix.
go get github.com/stripe/smokescreen@v0.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of Smokescreen.
Conclusion
In conclusion, the Smokescreen package has a vulnerability that allows bypassing the deny list feature, potentially leading to unauthorized access to internal infrastructure. To mitigate this vulnerability, it is recommended to upgrade to the latest version of Smokescreen. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/stripe/smokescreen →
FAQ
Smokescreen is a Go package developed by Stripe that helps prevent server-side request forgery (SSRF) attacks by blocking access to external URLs.
The deny list feature in Smokescreen allows users to block access to additional URLs, preventing potential SSRF attacks.
By appending a dot to the end of a user-supplied URL or providing input in a different letter case, an attacker can bypass the deny list and potentially access restricted resources.
This vulnerability can be exploited to perform unauthorized actions or gain unauthorized access to internal infrastructure.
The severity of this vulnerability is moderate, with a CVSS score of 5.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/stripe/smokescreen.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
