CVE-2023-54397: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python-tornadoto a version that resolves this vulnerability.Fixed in 6.4.2-3+deb13u2Fixed in 6.5.5-5
Event History
Frequently Asked Questions
Which deployments are exposed to request smuggling?
Deployments running Tornado before 6.3.3 behind certain proxies are exposed when the proxy's Content-Length validation can be bypassed by non-standard characters accepted by Tornado.
What does an attacker need to exploit this issue?
An attacker needs network access to send crafted HTTP requests. No privileges or user interaction are required, but exploitation depends on the affected Tornado deployment being behind a susceptible proxy.
What should be done if upgrading is not immediately possible?
The provided information does not identify a workaround. Prioritize upgrading Tornado to 6.3.3 or later and review proxy handling of malformed or non-standard Content-Length headers.