by Kastro
Paper/Archive/CVE-2024-14029

CVE-2024-14029

tornadoweb tornado — Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

EPSS 0.4%public exploitCVSS 9.0
critical.is priorityof 100
43
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 29.9.299 × 206.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

Affected

ProductAffectedFixed inSource
tornado< 6.4.16.4.1CNA

Scores by source

VulnCheck (CNA)9.0CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
VulnCheck (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitgithub.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6gwriteupvulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling-via-transfer-encoding