Executive brief
Tornado is a popular Python web server framework used to build high-performance web applications. When deployed behind proxy servers, Tornado mishandles HTTP requests containing duplicate Transfer-Encoding headers, allowing attackers to smuggle malicious requests through to the backend. This can lead to bypassing access controls, poisoning cached content, or disrupting legitimate user connections.
Technical details
The vulnerability is an HTTP request smuggling issue (CWE-444) caused by Tornado's inconsistent parsing of duplicate Transfer-Encoding: chunked headers. When Tornado receives two Transfer-Encoding: chunked headers, it ignores both and treats the request as having no message body, while a proxy in front of it may parse the request differently. An attacker can craft a request where the proxy forwards the chunked body as the request body, but Tornado interprets it as a separate HTTP request. This occurs when Tornado is deployed behind proxies like Pound that emit duplicate Transfer-Encoding headers. The attack requires network access to the proxy-fronted Tornado instance and no authentication. Attackers can achieve ACL bypass, cache poisoning, or connection desynchronization. The vulnerability is fixed in Tornado 6.4.1 and later.
Affected products
- Tornado Tornado before 6.4.1
Timeline
- 2024-06-06: disclosed: GitHub Security Advisory GHSA-753j-mpmx-qq6g published
- 2024-06-06: patched: Fix released in Tornado 6.4.1
- 2026-09-15: advisory: CVE-2024-14029 published