CVE-2025-67724
BaseFortify
Publication date: 2025-12-12
Last updated on: 2025-12-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tornadoweb | tornado | to 6.5.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-644 | The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Tornado (versions 6.5.2 and below) involves the use of an unescaped 'reason' phrase in HTTP headers and HTML error pages. The 'reason' phrase, which is intended to provide custom status messages in HTTP responses, can be exploited if untrusted or malicious data is passed into it. This can lead to HTTP header injection when used in headers or cross-site scripting (XSS) when rendered in the default error page HTML.
How can this vulnerability impact me? :
Exploiting this vulnerability can allow attackers to perform HTTP header injection or cross-site scripting (XSS) attacks. This can lead to security issues such as session hijacking, information disclosure, or manipulation of HTTP responses, potentially compromising the security and integrity of web applications using affected Tornado versions.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Tornado to version 6.5.3 or later, where this vulnerability is fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows for header injection and reflected cross-site scripting (XSS) attacks, which can lead to session token theft, cross-site request forgery (CSRF), UI spoofing, or other client-side attacks. Such security issues could potentially result in unauthorized access to sensitive data or user sessions, thereby impacting compliance with standards like GDPR or HIPAA that require protection of personal and sensitive information. However, the direct impact on compliance depends on whether untrusted input is passed to the vulnerable 'reason' argument and if the application is exploited. Mitigation involves upgrading to Tornado 6.5.3 or later and avoiding untrusted input in the 'reason' argument. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, you should first identify if your system is running Tornado version 6.5.2 or below. You can check the Tornado version by running the command `pip show tornado` in your Python environment. Additionally, to detect exploitation attempts, monitor HTTP responses for unusual or suspicious reason phrases in status lines or error pages that include unescaped input. Network monitoring tools or web application firewalls (WAF) can be configured to alert on HTTP headers or error pages containing suspicious or injected content in the reason phrase. Since the vulnerability involves unescaped user input in the HTTP reason phrase, you can also search your application logs for instances where the `reason` argument is set dynamically from user input. There are no specific commands provided in the resources, but general detection involves version checking and monitoring HTTP responses for header injection or reflected XSS patterns. [2]