TI-2022-11731 Aliases CVE-2022-29188 GHSA-qwrf-gfpj-qvj6

Smokescreen SSRF via deny list bypass (square brackets) in Smokescreen

LOW 36CWE-918Published 2022-05-20 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by surrounding the hostname with square brackets (e.g. `[example.com]`). This only impacted the HTTP proxy functionality of Smokescreen. HTTPS requests were not impacted. Smokescreen version 0.0.4 contains a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00869 58th percentileScored 2026-11-07

Fix Fixed smokescreen (stripe): 0.0.4github.com/stripe/smokescreen (Go): 0.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
stripe	smokescreen	before 0.0.4	0.0.4	Patch available	CNA
—	github.com/stripe/smokescreen (Go)	before 0.0.4	0.0.4	Patch available	GHSA-qwrf-gfpj-qvj6

smokescreen Vendorstripe Affected before 0.0.4 Fixed in 0.0.4 Patch available CNA
github.com/stripe/smokescreen (Go) Vendor— Affected before 0.0.4 Fixed in 0.0.4 Patch available GHSA-qwrf-gfpj-qvj6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:stripe:smokescreen::::::::	before 0.0.4	Vulnerable	stripe

cpe:2.3:a:stripe:smokescreen:*:*:*:*:*:*:*:* Versions before 0.0.4 Vulnerable ·stripe

Remediation

Fix · CNA smokescreen (stripe) Fixed in 0.0.4
Fix · GHSA-qwrf-gfpj-qvj6 github.com/stripe/smokescreen (Go) Fixed in 0.0.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-29188
2026-10-03 Alias added: GHSA-qwrf-gfpj-qvj6

References

Patch 1

https://github.com/stripe/smokescreen/commit/dea7b3c89df000f4072ff9866d61d78e30df6a36

Advisory 2

TI-2022-08638 Smokescreen SSRF via deny list bypass CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences