Executive Summary

This vulnerability exists in Tornado versions 6.5.2 and below, where a single maliciously crafted HTTP request can block the server's event loop for an extended period. It is caused by the HTTPHeaders.add method, which concatenates strings when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in quadratic time complexity (O(n²)) and causing a Denial of Service (DoS).

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a Denial of Service (DoS) by blocking the server's event loop, potentially making the server unresponsive. The severity ranges from low to high depending on the max_header_size setting; if increased from the default 64KB, the impact can be high, otherwise it is lower.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Tornado to version 6.5.3 or later, where this issue is fixed. Additionally, avoid increasing the max_header_size beyond its default value of 64KB to reduce severity.

Useful 0 Not Useful 0

Compliance Impact

The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for HTTP requests that contain a large number of repeated headers with the same name, which cause excessive processing time in the Tornado server's event loop. To detect potential exploitation attempts, you can capture and analyze HTTP traffic for requests with many repeated headers. For example, using tcpdump or tshark to capture HTTP traffic and then filtering for repeated headers. A sample command to capture HTTP traffic on port 80 is: tcpdump -A -s 0 'tcp port 80'. Then, inspect the captured requests for repeated headers. Alternatively, using tshark to filter HTTP headers: tshark -Y 'http.header' -T fields -e http.header. Since the vulnerability involves repeated headers causing DoS, detecting unusually high counts of the same header in requests can indicate exploitation attempts. Additionally, monitoring Tornado server logs for slow request processing or event loop blocking can help detect this issue. However, no specific built-in Tornado commands or scripts are provided in the resources. [2]

Useful 0 Not Useful 0