TI-2022-08638 Aliases CVE-2022-24825 GHSA-gcj7-j438-hjj2

Smokescreen SSRF via deny list bypass

LOW 34CWE-918Published 2022-04-19 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by appending a dot to the end of user-supplied URLs, or by providing input in a different letter case. Recommended to upgrade Smokescreen to version 0.0.3 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0093 60th percentileScored 2026-11-07

Fix Fixed smokescreen (stripe): 0.0.3github.com/stripe/smokescreen (Go): 0.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
stripe	smokescreen	before 0.0.3	0.0.3	Patch available	CNA
—	github.com/stripe/smokescreen (Go)	before 0.0.3	0.0.3	Patch available	GHSA-gcj7-j438-hjj2

smokescreen Vendorstripe Affected before 0.0.3 Fixed in 0.0.3 Patch available CNA
github.com/stripe/smokescreen (Go) Vendor— Affected before 0.0.3 Fixed in 0.0.3 Patch available GHSA-gcj7-j438-hjj2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:stripe:smokescreen::::::::	before 0.0.3	Vulnerable	stripe

cpe:2.3:a:stripe:smokescreen:*:*:*:*:*:*:*:* Versions before 0.0.3 Vulnerable ·stripe

Remediation

Fix · CNA smokescreen (stripe) Fixed in 0.0.3
Fix · GHSA-gcj7-j438-hjj2 github.com/stripe/smokescreen (Go) Fixed in 0.0.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-24825
2026-10-03 Alias added: GHSA-gcj7-j438-hjj2

References

Advisory 3

Other 1

https://github.com/stripe/smokescreen/commit/fafb6ae48c6c40aa011d87b61306abc48db8797b

TI-2022-11731 Smokescreen SSRF via deny list bypass (square brackets) in Smokescreen CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences