Description

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access_token cookie, which are reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-24T15:16:38.090Z",
  "pubdate": "2026-08-24T15:16:38.090Z",
  "executiveSummary": "An improper neutralization of CRLF sequences vulnerability exists within TIM Flow prior to version 26.0.6.\nThe vulnerability allows remote, unauthenticated attackers to inject arbitrary HTTP headers and response body content into HTTP responses.\nExploitation occurs when unsanitized carriage return and line feed sequences are supplied via the rt URL parameter and the access_token cookie, which are subsequently reflected directly into Set-Cookie response headers.\nThe primary impact of this flaw includes HTTP Response Splitting, cross-site scripting (XSS), session token theft, and unauthorized account credential modification.\nAttackers can leverage this capability by crafting malicious links or requests designed to induce authenticated users into executing arbitrary JavaScript within their browser context.\nThe risk implications are severe, as successful exploitation compromises user session integrity and permits unauthorized administrative or user-level actions.\nPrerequisites for exploitation involve enticing an authenticated victim to interact with a specifically crafted malicious request containing malicious CRLF injection sequences.",
  "technicalDetails": "The root cause of the vulnerability is the lack of proper input validation and sanitization on user-supplied data before it is processed and reflected into HTTP response headers.\nSpecifically, the vulnerable components process unsanitized carriage return (%0D) and line feed (%0A) sequences present within the rt URL parameter and the access_token cookie.\nBecause the application fails to strip or encode these control characters, they are directly echoed back into the application's Set-Cookie response headers.\nThis enables an attacker to inject arbitrary HTTP header fields and manipulate the structure of the HTTP response, a technique commonly known as HTTP Response Splitting.\nBy terminating the HTTP header block prematurely using injected CRLF sequences, an attacker can append arbitrary HTTP headers or inject arbitrary payload content directly into the HTTP response body.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious Uniform Resource Identifier or cookie payload containing injected %0D%0A sequences followed by arbitrary headers or script content. 2) The attacker induces an authenticated user to transmit this request to the TIM Flow server. 3) The TIM Flow application reflects the unsanitized input into the Set-Cookie response header. 4) The victim's web browser interprets the injected response headers and body content, leading to the execution of arbitrary JavaScript within the victim browser context.\nThe affected product is TIM Flow, and all versions before 26.0.6 are vulnerable.\nNetwork exposure is remote, allowing any external attacker capable of reaching the web application to attempt exploitation.\nAuthentication requirements vary depending on the vector, but the full impact involving session theft and credential modification requires the victim to be authenticated.\nPost-exploitation impact includes the execution of arbitrary JavaScript in the context of the victim session, enabling session hijacking via token theft, unauthorized modification of user credentials, and further client-side compromise."
}