Symlink Attacktornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Affected versions of this package are vulnerable to Symlink Attack via StaticFileHandler.validate_absolute_path in tornado/web.py, which uses os.path.abspath to validate that a requested path remains within the configured static root directory but does not resolve symlinks. An attacker can place or exploit a symlink inside the static directory that points to an arbitrary location on the filesystem, causing StaticFileHandler to serve files outside the intended root - both symlinked files and symlinked directories are affected. The fix introduces a secondary check using os.path.realpath against a configurable allowed_symlink_directory boundary.
Note: This is only exploitable when a symlink exists inside the configured static directory pointing to a location outside it.
How to fix Symlink Attack? Upgrade tornado to version 6.5.9 or higher.
| |
Improper Handling of Highly Compressed Data (Data Amplification)tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via curl_httpclient.py in CurlAsyncHTTPClient, which passes every chunk libcurl produces to IOLoop.add_callback without bounding the amount of buffered data. When decompress_response is enabled, an attacker-controlled server can send a decompression bomb - a small compressed payload that expands to gigabytes - causing all decompressed chunks to accumulate in the IOLoop's callback queue and exhausting process memory. Additionally, without a streaming_callback, curl_httpclient had no max_body_size limit, allowing a server to buffer arbitrarily large response bodies.
How to fix Improper Handling of Highly Compressed Data (Data Amplification)? Upgrade tornado to version 6.5.9 or higher.
| |
Allocation of Resources Without Limits or Throttlingtornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in HTTPServerRequest.__init__ in tornado/httputil.py via query strings with a large number of fields. The parse_qs_bytes call used to parse the query string had no argument count limit, allowing an attacker to send a request with a query string containing a very large number of fields and trigger superlinear CPU consumption. In the default configuration, max_header_size (64 KB) caps the query string at roughly 12,700 arguments, which still imposes approximately 47 ms of CPU per request - an order of magnitude beyond the limit enforced on the body path - and applications that raise max_header_size face a proportionally larger impact.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade tornado to version 6.5.9 or higher.
| |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the set_cookie method when attacker-controlled keyword arguments with capitalized names are passed, bypassing character validation and allowing injection of arbitrary cookie attributes. An attacker can manipulate cookie attributes by supplying specially crafted values through capitalized keyword arguments.
Note: This is only exploitable if the application uses capitalized or legacy keyword arguments in the set_cookie method.
How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')? Upgrade tornado to version 6.5.8 or higher.
| |
Allocation of Resources Without Limits or Throttlingtornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via parse_multipart_form_data in tornado/httputil.py, where the max_parts limit was enforced only after splitting the entire multipart body into parts. An attacker can send a multipart request with an excessive number of boundary-delimited parts, causing the str.split() call to allocate a large temporary list before the limit check is applied, resulting in CPU and memory amplification. The fix passes config.max_parts + 1 as the maxsplit argument so the split is bounded before the check.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade tornado to version 6.5.8 or higher.
| |
Allocation of Resources Without Limits or Throttlingtornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through parse_body_arguments in tornado/httputil.py and parse_qs_bytes in tornado/escape.py. An attacker can stall the event loop and block the server by sending an application/x-www-form-urlencoded request body containing a huge number of separators and arguments. The body is parsed synchronously before the handler runs, so one oversized form request can consume excessive CPU and prevent the server from serving other connections.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade tornado to version 6.5.8 or higher.
| |
