Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-3hv7-mjh2-fv65, describes an unbounded query-string argument count in Tornado, leading to a Denial of Service (DoS). The core issue lies in the HTTPServerRequest.__init__ method within tornado/httputil.py. This method was responsible for parsing the URL query string using parse_qs_bytes. Crucially, in the vulnerable version (<= 6.5.8), this call to parse_qs_bytes did not include the max_num_fields argument. This omission meant that an attacker could send a GET request with an arbitrarily large number of query parameters. Parsing these numerous parameters is a CPU-intensive operation that executes synchronously on Tornado's single-threaded IOLoop. By flooding the server with such requests, an attacker could consume significant CPU resources, causing the event loop to stall and degrade performance for all other clients, thus achieving a DoS.
The provided commit 03945136ea9746eccf61caf88edae39642e59c93 clearly shows the fix applied to tornado/httputil.py. The line - self.arguments = parse_qs_bytes(self.query, keep_blank_values=True) was removed and replaced with a try/except block that includes max_num_fields=_DEFAULT_PARSE_BODY_CONFIG.urlencoded.max_arguments in the parse_qs_bytes call. This change directly addresses the unbounded nature of the query string parsing. Therefore, the HTTPServerRequest.__init__ method is identified as the vulnerable function because it contained the code responsible for processing the malicious input without proper limits.
tornado.httputil.HTTPServerRequest.__init__tornado/httputil.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tornado | pip | <= 6.5.8 | 6.5.9 |
max_header_sizeIOLoop. Several such requests in flight concurrently stall the event
loop, delaying processing of all other connections on that loop — not just the
attacker's own request.Ran the unmodified v6.5.8 source directly (no external dependencies needed) with a minimal
tornado.web.Application on 127.0.0.1:8888.
200 OK; sent as POST body
(application/x-www-form-urlencoded) → 400 Bad Request (correctly rejected by the
existing max_num_fields body-path limit). This confirms the asymmetry directly./?a=1) averaged 1.86ms; the 7800-field query string
averaged 25.1ms (~13x).All Tornado servers/applications are affected — this triggers on every request with a query
string, independent of application/handler logic. An unauthenticated, unprivileged remote
attacker can measurably degrade response times for all other clients sharing the same
IOLoop, using a small amount of bandwidth and no special conditions. This is an
availability/DoS concern; no confidentiality or integrity impact.
# tornado/httputil.py — HTTPServerRequest.__init__
if uri is not None:
self.path, sep, self.query = uri.partition("?")
try:
self.arguments = parse_qs_bytes(
self.query,
keep_blank_values=True,
max_num_fields=_DEFAULT_PARSE_BODY_CONFIG.urlencoded.max_arguments,
)
except ValueError as e:
raise HTTPInputError("Invalid query string: %s" % e) from e
This reuses the existing ParseUrlEncodedConfig.max_arguments default (1000) via the
module's _DEFAULT_PARSE_BODY_CONFIG, matching the POST-body limit and honoring any global
override via set_parse_body_config(). The try/except is necessary because — unlike
parse_body_arguments, which already wraps its call and converts ValueError into a clean
HTTPInputError/400 — the query-string call site currently has no such handling, so without
it, a request exceeding the limit would raise an uncaught ValueError instead of a clean 400.
Verified: with the fix applied, requests with ≤1000 query-string fields are unaffected;
requests with >1000 fields are rejected with 400 Bad Request (consistent with the POST-body
behavior); Tornado's own httputil_test and web_test suites (256 tests) pass unchanged.