CVE-2024-58384

A flaw was found in Tornado's CurlAsyncHTTPClient component. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the client fails to properly reject carriage return and line feed characters in HTTP request headers. A remote attacker can exploit this by injecting these characters into header values, allowing them to inject arbitrary headers or construct entirely new HTTP requests. This could potentially lead to server-side request forgery (SSRF) vulnerabilities.

Moderate impact: This CRLF injection vulnerability in Tornado's CurlAsyncHTTPClient allows attackers to inject arbitrary HTTP headers or construct new HTTP requests. Exploitation requires an application to process untrusted, attacker-controlled data directly into request headers when utilizing CurlAsyncHTTPClient, potentially facilitating Server-Side Request Forgery (SSRF).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications using Tornado's CurlAsyncHTTPClient should sanitize all header values to prevent CRLF injection. Alternatively, if feasible, applications can switch to using the standard AsyncHTTPClient which properly rejects CRLF characters in request headers. If a service is restarted or reloaded after implementing this change, ensure proper validation of the service's functionality.