Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Smokescreen SSRF via deny list bypass
Vulnerability Description
Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by appending a dot to the end of user-supplied URLs, or by providing input in a different letter case. Recommended to upgrade Smokescreen to version 0.0.3 or later.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
Smokescreen 代码问题漏洞
Vulnerability Description
Smokescreen是一个 HTTP CONNECT 代理。 Smokescreen存在安全漏洞，该漏洞源于可以通过在用户提供的 URL 末尾附加一个点或以不同的字母大小写提供输入来绕过拒绝列表功能。
CVSS Information
N/A
Vulnerability Type
N/A