GHSA-753j-mpmx-qq6g: 
Python vulnerability analysis and mitigation

A vulnerability (GHSA-753j-mpmx-qq6g) was discovered in Tornado web framework versions <= 6.4.0, where the application incorrectly handles requests with multiple Transfer-Encoding: chunked headers by ignoring them both. This vulnerability was published on June 6, 2024, and has been patched in version 6.4.1. The issue is classified as a Moderate severity vulnerability with a CVSS score of 5.3 (GitHub Advisory).

The vulnerability stems from Tornado's handling of HTTP requests containing duplicate Transfer-Encoding: chunked headers. When such requests are received, Tornado incorrectly processes them by ignoring both headers, leading to potential request smuggling vulnerabilities. This behavior becomes particularly problematic when Tornado is deployed behind proxy servers that emit requests with multiple Transfer-Encoding headers. The issue is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests) and has been assigned a CVSS v3.1 base score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) (GitHub Advisory).

The vulnerability can lead to several security implications when Tornado is deployed behind a proxy. The potential impacts include ACL bypass, cache poisoning, and connection desynchronization. This is particularly concerning in scenarios where the proxy forwards requests containing multiple Transfer-Encoding: chunked headers (GitHub Advisory).

The vulnerability can be exploited by sending specially crafted HTTP requests with multiple Transfer-Encoding: chunked headers. When such requests are processed through a proxy server that forwards these headers, it can lead to request smuggling. The exploit can be further enhanced using chunk-exts to trigger a 405 response instead of a 400, potentially leading to connection desynchronization (GitHub Advisory).

The vulnerability has been patched in Tornado version 6.4.1. Users are advised to upgrade to this version or later to address the security issue. The fix includes stricter handling of transfer-encoding and whitespace in HTTP requests (GitHub Commit).