CVE-2022-29188

Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by surrounding the hostname with square brackets (e.g. `[example.com]`). This only impacted the HTTP proxy functionality of Smokescreen. HTTPS requests were not impacted. Smokescreen version 0.0.4 contains a patch for this issue.

• CWE-918

• https://github.com/stripe/smokescreen/commit/dea7b3c89df000f4072ff9866d61d78e30df6a36Patch, Third Party Advisory
• https://github.com/stripe/smokescreen/security/advisories/GHSA-qwrf-gfpj-qvj6Third Party Advisory
• https://github.com/stripe/smokescreen/commit/dea7b3c89df000f4072ff9866d61d78e30df6a36Patch, Third Party Advisory
• https://github.com/stripe/smokescreen/security/advisories/GHSA-qwrf-gfpj-qvj6Third Party Advisory

Published

May 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29182GoCD is a continuous delivery server. GoCD versions 19.11.0 …5.4
• CVE-2022-29183GoCD is a continuous delivery server. GoCD versions 20.2.0 u…6.1
• CVE-2022-29184GoCD is a continuous delivery server. In GoCD versions prior…8.8
• CVE-2022-29185totp-rs is a Rust library that permits the creation of 2FA a…4.4
• CVE-2022-29186Rundeck is an open source automation service with a web cons…9.8
• CVE-2022-29187Git is a distributed revision control system. Git prior to v…7.8
• CVE-2022-29189Pion DTLS is a Go implementation of Datagram Transport Layer…5.3
• CVE-2022-29190Pion DTLS is a Go implementation of Datagram Transport Layer…7.5
• CVE-2022-29191TensorFlow is an open source platform for machine learning. …5.5
• CVE-2022-29192TensorFlow is an open source platform for machine learning. …5.5
• CVE-2022-29193TensorFlow is an open source platform for machine learning. …5.5
• CVE-2022-29194TensorFlow is an open source platform for machine learning. …5.5