HTTP Request Smuggling Vulnerability in Tornado

Tornado versions prior to 6.4.1 contain a vulnerability that allows for HTTP request smuggling. The flaw exists because the library incorrectly processes duplicate 'Transfer-Encoding: chunked' headers. When an application using an affected version of Tornado is deployed behind a front-end proxy, the inconsistency between how the proxy and the back-end (Tornado) interpret the request boundaries can be exploited.

By sending a specially crafted request containing duplicate headers, an attacker can cause Tornado to treat the request as having no message body while simultaneously interpreting the payload as the start of a subsequent, legitimate request. This desynchronization of the HTTP connection allows an attacker to inject requests into the stream processed by the server. This can lead to serious security consequences, including unauthorized access to internal resources, cache poisoning of front-end servers, or the bypassing of security filters applied by the proxy.

Impact

Successful exploitation allows for connection desynchronization between a proxy and the back-end Tornado server. This enables attackers to perform unauthorized actions such as accessing restricted endpoints, manipulating cached content to serve malicious data to other users, or completely bypassing access control mechanisms. The scope of impact is dependent on the infrastructure configuration, specifically the combination of the front-end proxy and the Tornado-backed application.

Recommendation

• Upgrade all instances of Tornado to version 6.4.1 or later to remediate CVE-2024-14029.
• Audit proxy configurations to ensure that incoming requests are normalized and that ambiguous or conflicting 'Transfer-Encoding' headers are sanitized or rejected before being forwarded to the application tier.
• Monitor web logs for non-standard HTTP request patterns, such as multiple 'Transfer-Encoding' headers, which may indicate attempts to probe for request smuggling vulnerabilities.