CVE-2024-58384: Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Tornado versions before 6.4.1 and making outbound HTTP requests through CurlAsyncHTTPClient are exposed when attacker-controlled data can reach request header values.
What does an attacker need to exploit this issue?
An attacker needs a way to cause carriage return and line feed characters to be included in header values used by CurlAsyncHTTPClient. No authentication or user interaction is required according to the supplied vector, but exploitation has high attack complexity.
What is the potential impact of successful exploitation?
An attacker can inject arbitrary HTTP headers or construct entirely new HTTP requests through the affected client. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.