CRLF Injection Vulnerability in TIM Flow

TIM Flow versions prior to 26.0.6 contain a CRLF injection vulnerability that allows remote, unauthenticated attackers to inject arbitrary HTTP headers and response body content. The vulnerability stems from the improper sanitization of carriage return (%0D) and line feed (%0A) sequences within the 'rt' URL parameter and the 'access_token' cookie. Because these inputs are reflected directly into 'Set-Cookie' response headers, an attacker can terminate the header block prematurely and inject malicious JavaScript into the response body. This attack vector facilitates Reflected Cross-Site Scripting (XSS), which can be leveraged to hijack authenticated session tokens, exfiltrate sensitive user data, or modify account credentials. Organizations running TIM Flow must upgrade to version 26.0.6 or later to mitigate this risk.

Impact

Successful exploitation leads to the execution of arbitrary JavaScript within the context of an authenticated user session. This results in the complete compromise of the user account, including session hijacking and unauthorized changes to account configuration.

Recommendation

• Patch all instances of TIM Flow to version 26.0.6 or later immediately.
• Audit web application logs for HTTP requests containing encoded newline characters (0x0D0A) within the 'rt' parameter or 'access_token' cookie.
• Implement strict input validation on all URL parameters and cookies to block CRLF sequences.