An HTTP header injection vulnerability in TIM Flow allows attackers to manipulate HTTP responses, creating risks of cross-site scripting and cache poisoning.

The software is vulnerable to CRLF injection (CWE-113) within the rt parameter. By injecting carriage return and line feed characters, an unauthenticated attacker can manipulate HTTP headers, which may result in response splitting or similar injection-based attacks.

This vulnerability can be leveraged to conduct cross-site scripting (XSS) or cache poisoning, leading to potential account hijacking, session theft, or the distribution of malicious content to users. Given the high CVSS score of 8.1, this represents a significant threat to user security and the overall reputation of the affected web service.

Immediate Action: Update TIM Flow to version 26.0.6 or later to include the necessary sanitization for HTTP headers.

Proactive Monitoring: Monitor web traffic for requests containing encoded CRLF characters or unusual header patterns that may indicate injection attempts.

Compensating Controls: Implement strict input validation on all URL parameters and deploy a WAF with rules configured to block CRLF sequences in HTTP traffic.

Public Exploit Available: No

The update to version 26.0.6 is mandatory to secure the application against header injection. Security teams should prioritize patching this vulnerability to prevent potential session-based attacks against their user base.