Skip to content

Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths

Moderate severity GitHub Reviewed Published Aug 12, 2023 in tornadoweb/tornado • Updated Sep 7, 2023

Package

pip tornado (pip)

Affected versions

< 6.3.3

Patched versions

6.3.3

Description

Summary

Tornado interprets -, +, and _ in chunk length and Content-Length values, which are not allowed by the HTTP RFCs. This can result in request smuggling when Tornado is deployed behind certain proxies that interpret those non-standard characters differently. This is known to apply to older versions of haproxy, although the current release is not affected.

Details

Tornado uses the int constructor to parse the values of Content-Length headers and chunk lengths in the following locations:

tornado/http1connection.py:445

            self._expected_content_remaining = int(headers["Content-Length"])

tornado/http1connection.py:621

                content_length = int(headers["Content-Length"])  # type: Optional[int]

tornado/http1connection.py:671

            chunk_len = int(chunk_len_str.strip(), 16)

Because int("0_0") == int("+0") == int("-0") == int("0"), using the int constructor to parse and validate strings that should contain only ASCII digits is not a good strategy.

References

@bdarnell bdarnell published to tornadoweb/tornado Aug 12, 2023
Published to the GitHub Advisory Database Aug 14, 2023
Reviewed Aug 14, 2023
Last updated Sep 7, 2023

Severity

Moderate

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-qppv-j76h-2rpx

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.