CVE-2022-29188 Smokescreen SSRF via deny list bypass (square brackets) in Smokescreen

What is CVE-2022-29188?

CVE-2022-29188 is a medium-severity server-side request forgery vulnerability in stripe smokescreen, published on 20 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by surrounding the hostname with square brackets (e.g. `[example.com]`). This only impacted the HTTP proxy functionality of Smokescreen. HTTPS requests were not impacted. Smokescreen version 0.0.4 contains a patch for this issue.

Weakness: CWE-918

Which versions are affected by CVE-2022-29188?

3 open source packages ship an affected version, including github.com/stripe/smokescreen. It affects 1 product.

Products include Stripe Smokescreen.

How do I fix CVE-2022-29188?

Upgrade github.com/stripe/smokescreen to 0.0.4 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-29188 being exploited?

There is no known exploitation of CVE-2022-29188 in the wild and no public exploit code.

Other vulnerabilities in stripe smokescreen

• CVE-2022-24825 Smokescreen SSRF via deny list bypass Medium 5.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qwrf-gfpj-qvj6, GO-2022-0459.