Executive brief
Tornado, a popular Python web framework and networking library, is vulnerable to attacks that could allow malicious actors to inject unauthorized web headers or execute malicious scripts in a user's browser. This occurs when an application uses untrusted data to define custom HTTP error messages. If exploited, this could lead to unauthorized actions on behalf of users, such as stealing session information or redirecting users to malicious websites.
Technical details
Tornado versions prior to 6.5.3 fail to properly sanitize the 'reason' argument used in RequestHandler.set_status and tornado.web.HTTPError. This argument is intended for custom HTTP status phrases but is reflected unescaped in both the HTTP status line (leading to header injection) and the default HTML error page (leading to reflected XSS). An attacker can exploit this by providing malicious input to an application that reflects user-controlled data into these error-handling functions. The vulnerability is mitigated in version 6.5.3 by escaping the input; developers can also mitigate this by avoiding the use of untrusted data in the 'reason' field or using 'log_message' for internal error details.
Affected products
- tornadoweb tornado < 6.5.3
Timeline
- 2025-12-11: disclosed: Vulnerability reported and initial advisory published
- 2025-12-12: advisory: NVD publication date
- 2026-07-20: advisory: GitHub Advisory reviewed and updated