# Bypass global deny-lists by wrapping domains using "[]" in https://github.com/stripe/smokescreen

Smokescreen's deny-list could be bypassed by wrapping the hostname in square brackets (e.g. http://[example.com]:80), letting internal services reach blocked URLs.

- Payout: hidden
- Severity: low
- Program: Stripe
- Found by: haxatron1
- Disclosed: 2022-05-18
- CVE: CVE-2022-29188
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1528242
- Library page: https://bugbountylibrary.com/r/h1%3A1528242
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:low tech:go technique:parser-differential vuln:access-control vuln:ssrf

**Target:** HTTP CONNECT proxy deny-list (Smokescreen)
**Root cause:** The deny-list matcher parsed the hostname without stripping square brackets, so a bracketed host like [example.com] did not match the deny-list entry for example.com, while the underlying connection still resolved to the blocked host.
**Steps:**
1. Configure Smokescreen with a deny-list containing `example.com`.
2. Send a request through the proxy to `http://[example.com]:80`.
3. Observe the deny-list is not triggered and the connection proceeds to the blocked host.
**How found:** Researcher noticed the deny-list matching logic likely handled hostnames literally and tested alternate hostname encodings, finding that bracketed hosts (IPv6-style syntax) bypassed matching.
**Exploitation:** An attacker who can influence URLs fetched by an internal service using Smokescreen can wrap the target hostname in brackets to evade the deny-list and reach otherwise-blocked external or internal destinations, enabling SSRF beyond the configured restrictions.
**Insight:** When auditing SSRF proxies/deny-lists, test alternate hostname encodings (brackets, trailing dots, userinfo, mixed case, ports) against the matcher versus the actual resolver to find parser differentials.