Executive brief
Tornado, a popular Python web framework, improperly parses HTTP Content-Length headers by accepting non-standard characters (hyphens, plus signs, underscores) that should not be allowed. When Tornado runs behind certain proxies that reject these characters, attackers can craft malicious HTTP requests to bypass proxy validation and inject smuggled requests into the application, potentially allowing account takeover, cache poisoning, or unauthorized data access.
Technical details
Tornado versions before 6.3.3 use Python's int() constructor to parse Content-Length and chunk-length values without proper validation. The int() function accepts non-standard prefixes and separators (e.g., "+0", "-0", "0_0"), which diverge from HTTP RFC specifications that allow only ASCII digits. When deployed behind proxies that reject these non-standard formats, an attacker can send a request with ambiguous Content-Length interpretation, causing the proxy and Tornado to disagree on where the request ends, enabling HTTP request smuggling. This vulnerability is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests). The issue was patched in Tornado 6.3.3 by implementing stricter parsing logic for header values.
Affected products
- Tornado Tornado before 6.3.3
Timeline
- 2023-08-12: disclosed: Security advisory published on GitHub
- 2023: patched: Fixed in Tornado 6.3.3