CVE-2022-29188 json
Smokescreen SSRF via deny list bypass (square brackets) in Smokescreen
published 2022-05-20 4 y ago modified 2026-06-17 4 mo ago also GHSA-qwrf-gfpj-qvj6 , GO-2022-0459 , EUVD-2022-5049
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by surrounding the hostname with square brackets (e.g. `[example.com]`). This only impacted the HTTP proxy functionality of Smokescreen. HTTPS requests were not impacted. Smokescreen version 0.0.4 contains a patch for this issue.
Patch / fix
- go github.com/stripe/smokescreen 0.0.4
- stripe smokescreen 0.0.4
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/stripe/smokescreen | <0.0.4 |
0.0.4 |
Affected products
- stripe smokescreen
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/stripe/smokescreen/commit/dea7b3c89df000f4072ff9866d61d78e30df6a36
web, patch, third-party-advisory
-
github.com
/stripe/smokescreen/security/advisories/GHSA-qwrf-gfpj-qvj6
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-29188
advisory
Sources
- CVE List CVE-2022-29188
- GitHub Advisory GHSA-qwrf-gfpj-qvj6
- NVD CVE-2022-29188
- OSV GO-2022-0459
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.