CyberRota Analysis
AI-GeneratedThe vulnerability in Tornado affects the SimpleAsyncHTTPClient, which improperly handles redirected requests by only removing the Host header while retaining sensitive headers such as Authorization and authentication credentials. This flaw could lead to unauthorized access or exposure of sensitive information during redirects. Organizations using Tornado versions prior to 6.5.6 should prioritize upgrading to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.