Ritlabs TinyWeb Server Request crlf injection

An attacker sends a crafted HTTP request containing `%0D%0A` (URL-encoded CRLF) sequences in the input that eventually reaches the `Location` response header. Because the server does not strip or neutralize CRLF characters before inserting attacker-controlled data into the response header, the attacker can inject arbitrary HTTP headers or split the response body. The attack is performed remotely over the network with no authentication required.

The vulnerability is in the `ReturnNewLocation` function within the TinyWeb server source code. The function directly assigns the `ALocation` parameter to `d.ResponseResponseHeader.Location` without sanitization [ref_id=1]. The patch introduces a new `StripCRLF` helper function and applies it to the `Location` header assignment to neutralize CRLF sequences [ref_id=1].

The patch adds a `StripCRLF` function that removes all carriage return (`#13`) and line feed (`#10`) characters from a string [ref_id=1]. This function is then called on the `ALocation` value before it is assigned to `d.ResponseResponseHeader.Location` in `ReturnNewLocation` [ref_id=1]. By stripping CRLF characters from the Location header value, the server prevents an attacker from injecting arbitrary headers or splitting the HTTP response, closing the CRLF injection vector.

A public PoC is available at https://github.com/DMCERTCE/CRLF_Tiny. The repository provides exploit code that sends a crafted HTTP request with CRLF injection payloads to the TinyWeb server, demonstrating injection of arbitrary response headers.