Server-Side Request Forgery (SSRF)

2022-05-2309:33:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

server-side request forgery

ssrf

vulnerability

stripe

smokescreen

EPSS

0.001

Percentile

34.8%

JSON

github.com/stripe/smokescreen is vulnerable to server-side request forgery. The vulnerability exists in BuildProxy and handleConnect functions in smokescreen.go due to the deny list option that smokescreen offers which allows an attacker to bypass the deny list feature.