CVE-2024-14029: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tornadoto a version that resolves this vulnerability.Fixed in 6.4.1 - Compensating control
If upgrading Tornado to 6.4.1 is not immediately possible, place a reverse proxy/gateway that normalizes requests so that duplicate Transfer-Encoding headers are rejected or collapsed before they reach Tornado, to prevent HTTP request smuggling.
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Tornado deployments behind proxies are exposed to HTTP request smuggling because inconsistent request parsing between the proxy and Tornado can be exploited. The described impacts include access-control bypass, cache poisoning, and connection desynchronization.
What does an attacker need to send to exploit the flaw?
An attacker must be able to send a crafted HTTP request containing duplicate Transfer-Encoding: chunked headers. No authentication or user interaction is required, although the attack complexity is rated high.
Are affected versions known?
Tornado versions before 6.4.1 are affected. Upgrading to 6.4.1 or later removes the identified vulnerable version range.