CSRF Token Exposure in Python Tornado: CVE-2014-9720
Summary
CVE-2014-9720: Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a s... Affects python-tornado versions < 3.2.2-1. Fixed in 3.2.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Tornado is a scalable, non-blocking web server and web application framework designed to handle thousands of simultaneous connections efficiently. It is widely used for building web applications that require long-lived network connections, such as WebSockets. However, prior to version 3.2.2, Tornado had a vulnerability that allowed attackers to exploit the fixed CSRF token sent in responses, potentially compromising user sessions.
Vulnerability Detail
The vulnerability identified as CVE-2014-9720 affects Tornado versions before 3.2.2. It arises from the server's behavior of sending arbitrary responses containing a fixed CSRF token. This token can be exploited in a BREACH attack, where an attacker can determine the value of the CSRF token through a series of crafted requests. The implications of this vulnerability are significant, as it could allow unauthorized actions to be performed on behalf of users, leading to session hijacking and data breaches.
How To Fix
Minimum fixed version
3.2.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing additional security measures such as using a custom CSRF token for each session or request, and employing rate limiting to mitigate the risk of BREACH attacks.
Conclusion
CVE-2014-9720 is a significant vulnerability in Python Tornado that can lead to serious security risks if not addressed. Upgrading to version 3.2.2 or later is crucial to protect applications from potential attacks. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for python-tornado →
FAQ
CVE-2014-9720 is a vulnerability in Python Tornado that allows attackers to exploit a fixed CSRF token in responses, potentially leading to unauthorized actions.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The main consequence is the potential for session hijacking, where an attacker could perform actions on behalf of a user without their consent.
Yes, implementing additional security measures such as custom CSRF tokens and rate limiting can help mitigate the risk until an upgrade is possible.
The CVSS score for CVE-2014-9720 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-tornado.
