CVE-2024-58384

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.4.1

Description The curl httpclient.CurlAsyncHTTPClient class fails to reject carriage return (r) and line feed ( ) characters in request headers. This allows attackers to inject CRLF sequences into header values, enabling the injection of arbitrary headers or the construction of entirely new HTTP requests. This issue occurs because the client does not validate header names and values, passing them verbatim to libcurl and pycurl, which also lack validation for the HTTPHEADER option. This behavior may facilitate the exploitation of server-side request forgery (SSRF) vulnerabilities.

Recommendations Update Tornado to version 6.4.1 or later. As a temporary workaround, restrict the use of the curl httpclient.CurlAsyncHTTPClient class when handling untrusted header data.