Smokescreen SSRF via deny list bypass in github.com/stripe/smokescreen
Summary
CVE-2022-24825: Smokescreen SSRF via deny list bypass in github.com/stripe/smokescreen. Affects github.com/stripe/smokescreen versions < 0.0.3. Fixed in 0.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/stripe/smokescreen is a Go library that provides functionality for mitigating server-side request forgery (SSRF) attacks. It is designed to validate and sanitize user-supplied URLs to prevent unauthorized access to internal resources. However, a vulnerability has been discovered in the library that allows bypassing the deny list and potentially enabling SSRF attacks.
Vulnerability Detail
The vulnerability in github.com/stripe/smokescreen arises from a bypass in the deny list mechanism. The library is intended to block certain URLs that are known to be potentially dangerous or unauthorized. However, due to a flaw in the implementation, an attacker can craft a URL that bypasses the deny list and accesses restricted resources. This can lead to unauthorized information disclosure, data exfiltration, or even remote code execution on the server.
How To Fix
Latest published version: v0.1.0 as of 23 Oct 2026
go get github.com/stripe/smokescreen@v0.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.3
This is the first release that contains the fix.
go get github.com/stripe/smokescreen@v0.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually implement additional URL validation and filtering mechanisms to complement the functionality provided by github.com/stripe/smokescreen. This can involve checking the URL against a custom deny list or using a different library that is not affected by this vulnerability.
Conclusion
The vulnerability in github.com/stripe/smokescreen allows for bypassing the deny list and potentially enabling SSRF attacks. It is crucial to update to version 0.0.3 or later to fix this issue. In the meantime, implementing additional URL validation and filtering mechanisms can serve as a temporary workaround.
See every vulnerability recorded for github.com/stripe/smokescreen →
FAQ
Server-side request forgery (SSRF) is a type of vulnerability that allows an attacker to make requests to internal resources on a server from a vulnerable application. It can be used to bypass access controls, retrieve sensitive information, or perform actions on behalf of the server.
The bypass in github.com/stripe/smokescreen occurs due to a flaw in the deny list implementation. Attackers can craft URLs that exploit this flaw and bypass the deny list, allowing them to access restricted resources.
The vulnerability can lead to unauthorized access to internal resources, information disclosure, data exfiltration, or even remote code execution on the server. This can have serious security implications and compromise the integrity and confidentiality of the affected system.
Yes, a fix is available in version 0.0.3 of github.com/stripe/smokescreen. It is recommended to update to this version or a later one to mitigate the vulnerability.
As a temporary workaround, developers can implement additional URL validation and filtering mechanisms to complement the functionality of github.com/stripe/smokescreen. This can involve using a custom deny list or an alternative library that is not affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/stripe/smokescreen.
