Memory Exhaustion in Tornado via Gzip Decompression Bomb

Executive Summary

This vulnerability affects Tornado versions before 6.5.9 in the CurlAsyncHTTPClient component. It allows remote attackers to cause denial of service by sending a compressed response that triggers unbounded memory accumulation. Specifically, attackers can send a gzip-encoded decompression bomb, which expands into large amounts of data in memory without size limits, eventually killing the application process due to out-of-memory conditions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for applications using Tornado versions before 6.5.9 with CurlAsyncHTTPClient. Check for unusually high memory usage in Tornado-based applications when processing HTTP responses. Inspect network traffic for gzip-compressed responses from untrusted sources. Use commands like 'ps aux | grep tornado' to identify running Tornado processes and 'curl -I http://target' to check server responses for compression headers.

• Check Tornado version: python -c "import tornado; print(tornado.version)"
• Monitor memory usage: top -p $(pgrep -f tornado) or htop for Tornado processes
• Inspect HTTP responses: curl -v --compressed http://example.com to test compression handling

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable Tornado version (before 6.5.9) with CurlAsyncHTTPClient enabled, an attacker could send a malicious response to your application, causing it to consume excessive memory. This may lead to the application crashing or becoming unresponsive, resulting in downtime for services relying on Tornado. The attack requires no special privileges or user interaction, only that your application fetches a URL controlled by the attacker.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Tornado to version 6.5.9 or later. If upgrading is not possible, disable CurlAsyncHTTPClient by setting 'decompress_response=False' in CurlAsyncHTTPClient instances. Implement network-level protections like WAF rules to block gzip-compressed responses from untrusted sources. Set 'max_body_size' to a reasonable limit (e.g., 10MB) in CurlAsyncHTTPClient configurations.

• Upgrade Tornado: pip install --upgrade tornado>=6.5.9
• Disable decompression: client = CurlAsyncHTTPClient(decompress_response=False)
• Configure size limits: client = CurlAsyncHTTPClient(max_body_size=10485760)

Useful 0 Not Useful 0