GHSA-r4j5-9xpp-3985: Medium severity pip/tornado vulnerability
Summary
When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default maxbodysize of 100 MB can block the process for close to a minute, and the attacker can repeat or parallelize these requests.
Bodies made of tiny chunks also consumed far more memory than their size: a handler that does not use @streamrequestbody stored each chunk as a separate object, using roughly 20 times as much memory as the bytes received.
Impact
All Tornado HTTP servers are affected when they receive a request body for a handler that reads it, which includes any handler that does not reject the request before the body is read. No authentication is required. Lowering maxbodysize reduces the maximum blocking time and memory use for each request but does not remove the issue.
SimpleAsyncHTTPClient is affected in the same way when it reads a response from a malicious server.
Patches
Fixed in Tornado 6.6. Tornado now yields to the event loop periodically while reading any body, combines small chunks before passing them to datareceived, and stores non-streaming bodies more compactly.
Applications using @streamrequestbody should note that the pieces passed to datareceived no longer correspond to HTTP chunk boundaries.
Workarounds
- Run Tornado behind a reverse proxy that buffers request bodies and forwards them with a Content-Length header instead of chunked encoding. - Lower maxbodysize (for the whole server or for individual handlers) to limit the impact of each request.
Credit
Reported by uttej-badwane.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/tornadoto a version that resolves this vulnerability.Fixed in 6.6 - Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Fixed in 6.6 - Configuration
Lower max_body_size for the whole server or individual handlers to reduce the maximum blocking time and memory use of each request.
Tornado HTTP server max_body_size = lower than the default 100 MB - Compensating control
Run Tornado behind a reverse proxy that buffers request bodies and forwards them with a Content-Length header instead of chunked encoding.
Event History
Frequently Asked Questions
Which deployments are exposed?
All Tornado HTTP servers are affected when they receive a request body for a handler that reads it, including handlers that do not reject the request before the body is read. SimpleAsyncHTTPClient is also affected when reading a response from a malicious server.
What must an attacker do to trigger the issue?
An unauthenticated client can send an HTTP/1.1 chunked request body composed of very large numbers of 1-byte chunks. A malicious server can similarly send such a chunked response to a SimpleAsyncHTTPClient client.
Are default settings sufficient to limit the impact?
No. A body near the default 100 MB max_body_size can block the process for close to a minute, and handlers that do not use @stream_request_body can consume roughly 20 times the received body size in memory when chunks are tiny.
What mitigation is available if patching cannot happen immediately?
Lowering max_body_size reduces the maximum blocking time and memory use of each request. It does not eliminate the issue, and requests can still be repeated or parallelized.