CVE-2022-29188
Description
Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by surrounding the hostname with square brackets (e.g. `[example.com]`). This only impacted the HTTP proxy functionality of Smokescreen. HTTPS requests were not impacted. Smokescreen version 0.0.4 contains a patch for this issue.
How to fix
- stripe smokescreen0.0.4 or later
- github.com/stripe/smokescreen0.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stripe smokescreen | v < 0.0.4 | 0.0.4 |
| github.com/stripe/smokescreenGo | v < 0.0.4 | 0.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.