Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials

"Cloud security company Wiz has revealed that it uncovered in-the-wild exploitation of a security flaw in a Linux utility called Pandoc as part of attacks designed to infiltrate Amazon Web Services (AWS) Instance Metadata Service (IMDS). The vulnerability in question is CVE-2025-51591 (CVSS score: 6.5), which refers to a case of Server-Side Request Forgery (SSRF) that allows attackers to compromise a target system by injecting a specially crafted HTML iframe element."

"The EC2 IMDS is a crucial component of the AWS cloud environment, offering information about running instances, as well as temporary, short-lived credentials if an identity and access management (IAM) role is associated with the instance. The instance metadata is accessible to any application running on an EC2 instance via a link-local address (169.254.169[.]254). These credentials can then be used to securely interact with other AWS services like S3, RDS, or DynamoDB, permitting applications to authenticate without the need for storing credentials on the machine,"

"One of the common methods that attackers can use to steal IAM credentials from IMDS is via SSRF flaws in web applications. This essentially involves tricking the app running on an EC2 instance to send a request seeking IAM credentials from the IMDS service on its behalf. "If the application can reach the IMDS endpoint and is susceptible to SSRF, the attacker can harvest temporary credentials without needing any direct host access (such as RCE or path traversal)," Wiz researchers Hila Ramati and Gili Tikochinski"

Attackers exploited a Pandoc Server-Side Request Forgery vulnerability (CVE-2025-51591) to target the AWS EC2 Instance Metadata Service (IMDS). The SSRF allowed injection of a crafted HTML iframe to trick applications into requesting instance metadata, exposing temporary IAM credentials. Exposed credentials enable access to AWS services such as S3, RDS, and DynamoDB without stored keys. Any application on an EC2 instance that can reach the IMDS link-local address (169.254.169.254) and contains SSRF vulnerabilities is at risk. Threat actors have previously leveraged similar techniques to infiltrate AWS environments.

Read at The Hacker News