CVE-2023-54397: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to request smuggling?
Deployments running Tornado before 6.3.3 behind certain proxies are exposed when the proxy's Content-Length validation can be bypassed by non-standard characters accepted by Tornado.
What does an attacker need to exploit this issue?
An attacker needs network access to send crafted HTTP requests. No privileges or user interaction are required, but exploitation depends on the affected Tornado deployment being behind a susceptible proxy.
What should be done if upgrading is not immediately possible?
The provided information does not identify a workaround. Prioritize upgrading Tornado to 6.3.3 or later and review proxy handling of malformed or non-standard Content-Length headers.