CVE-2022-29188: Smokescreen SSRF via deny list bypass (square brackets)
Summary
CVE-2022-29188: Smokescreen SSRF via deny list bypass (square brackets). Affects github.com/stripe/smokescreen versions < 0.0.4. Fixed in 0.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Smokescreen is a Go package developed by Stripe that aims to prevent server-side request forgery (SSRF) attacks. It provides a mechanism to deny access to external URLs by using a deny list. This feature is designed to protect applications from connecting to or scanning internal infrastructure. However, a vulnerability in Smokescreen allows bypassing the deny list by enclosing the hostname with square brackets, such as '[example.com]'.
Vulnerability Detail
The vulnerability in Smokescreen allows an attacker to bypass the deny list feature by using square brackets around the hostname. By doing so, the attacker can trick the application into accessing URLs that should be blocked. This can lead to potential SSRF attacks and unauthorized access to internal infrastructure. The impact of this vulnerability is considered moderate, with a CVSS score of 5.3.
How To Fix
Minimum fixed version
0.0.4
This is the first release that contains the fix.
go get github.com/stripe/smokescreen@v0.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the patched version of Smokescreen to mitigate the risk.
Conclusion
The vulnerability in Smokescreen allows bypassing the deny list feature, potentially leading to SSRF attacks and unauthorized access to internal infrastructure. It is crucial to upgrade to the patched version of Smokescreen (0.0.4 or later) to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/stripe/smokescreen →
FAQ
Smokescreen is a Go package developed by Stripe to protect applications from server-side request forgery (SSRF) attacks.
The deny list feature in Smokescreen allows blocking access to external URLs, preventing applications from connecting to or scanning internal infrastructure.
The vulnerability occurs due to a flaw in the deny list feature, which can be bypassed by enclosing the hostname with square brackets.
The vulnerability can lead to server-side request forgery (SSRF) attacks and unauthorized access to internal infrastructure.
To fix this vulnerability, upgrade Smokescreen to version 0.0.4 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/stripe/smokescreen.
