Memory Amplification in Tornado Web Framework

Executive Summary

Tornado before 6.5.8 has a memory amplification vulnerability in the parse_multipart_form_data function. It splits multipart data into parts before checking the max_parts limit, allowing attackers to send crafted requests with many parts. This creates large temporary lists in memory, exhausting server resources and causing denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusually high memory usage during multipart form data processing. Check Tornado server logs for requests with excessive parts. Use tools like netstat or tcpdump to inspect incoming requests for large multipart payloads. Verify if your Tornado version is below 6.5.8.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to crash your Tornado server by sending a request with an excessive number of multipart parts. This would consume server memory, leading to degraded performance or complete downtime for your web application.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Tornado to version 6.5.8 or later. If upgrading is not possible, implement network-level protections to block or rate-limit large multipart requests. Monitor server memory usage closely and set up alerts for abnormal spikes.

Useful 0 Not Useful 0