Ethical Hacking News
A newly discovered SSRF flaw in Pandoc allows attackers to target AWS IMDS and steal EC2 IAM credentials, posing a significant threat to cloud infrastructure. Organizations must take proactive measures to secure their systems and mitigate this risk.
The discovery of a critical security flaw in Pandoc has exposed a Server-Side Request Forgery (SSRF) exploit that can compromise target systems, particularly cloud security related to AWS Instance Metadata Service (IMDS). Attackers can steal sensitive data by exploiting an SSRF flaw, which allows them to harvest temporary credentials from IMDS. A real-world attack has already taken place, with threat actors abusing credentials obtained using IMDS since July 2021. The core issue is that the IMDSv1 service is a request and response protocol, making it an attractive target for bad actors who seek to exploit exploitable web applications running IMDSv1. Enforcing IMDSv2 can mitigate this threat by mitigating SSRF attacks; however, organizations running unpatched vulnerable third-party software alongside instances using IMDSv1 may still be at risk.
The discovery of a critical security flaw in the popular document processing utility Pandoc has sent shockwaves through the cybersecurity community. The vulnerability, identified as CVE-2025-51591 with a CVSS score of 6.5, is a Server-Side Request Forgery (SSRF) exploit that allows attackers to compromise target systems by injecting specially crafted HTML iframe elements. This newly uncovered threat vector has far-reaching implications for cloud security, particularly in relation to the Amazon Web Services (AWS) Instance Metadata Service (IMDS).
The IMDS plays a crucial role in the AWS environment, providing information about running instances and offering temporary, short-lived credentials if an identity and access management (IAM) role is associated with the instance. These credentials can be used securely to interact with other AWS services like S3, RDS, or DynamoDB, thereby reducing the risk of accidental exposure. However, this very functionality also makes it a prime target for attackers seeking to steal sensitive data.
According to Wiz researchers Hila Ramati and Gili Tikochinski, one common method that attackers use to compromise IAM credentials is via SSRF flaws in web applications. This involves tricking an application running on an EC2 instance to send a request seeking IAM credentials from the IMDS service on its behalf. If the application can reach the IMDS endpoint and is susceptible to SSRF, the attacker can harvest temporary credentials without needing any direct host access.
The threat does not stem from a theoretical concept; real-world attacks are already taking place. Google-owned Mandiant found that a threat actor it tracks as UNC2903 had attacked AWS environments by abusing credentials obtained using IMDS since July 2021, exploiting an SSRF flaw (CVE-2021-21311, CVSS score: 7.2) in Adminer, an open-source database management tool, to facilitate data theft.
The core issue here is that the IMDSv1 service is a request and response protocol, making it an attractive target for bad actors who seek to exploit exploitable web applications running IMDSv1. Resecurity warned that when SSRF is exploited against cloud infrastructure like AWS, it can have "severe and far-reaching" consequences, resulting in cloud credential theft, network reconnaissance, and unauthorized access to internal services.
Wiz researchers revealed that they observed in-the-wild exploitation attempts dating back to August 2025 and continuing for a few weeks. These attacks involved exploiting the CVE-2025-51591 vulnerability in Pandoc, which allowed attackers to craft an HTML iframe whose src attribute targeted the AWS IMDS endpoint at 169.254.169[.]254. The objective was to render and exfiltrate the content of sensitive paths, specifically /latest/meta-data/iam/info and /latest/meta-data/iam.
Wiz stated that the attack was ultimately unsuccessful due to the enforcement of IMDSv2, which is session-oriented and mitigates SSRF attacks by first requiring a user to get a token and use that token in all requests to the IMDS via a special header (X-aws-ec2-metadata-token). However, Wiz noted that organizations running unpatched vulnerable third-party software alongside instances using IMDSv1 may still be at risk.
To mitigate this threat, it is advised to enforce IMDSv2 across all EC2 instances and ensure that instances are assigned roles that follow the principle of least privilege (PoLP) to contain the blast radius in the event of an IMDS compromise. Users can also take measures by using the "-f html+raw_html" option or the "--sandbox" option to prevent Pandoc from including the contents of iframe elements through the src attribute.
Organizations must remain vigilant and proactive in securing their cloud infrastructure against such threats. Given the widespread nature of this vulnerability, regular security audits and patch management are essential for protecting sensitive data and preventing unauthorized access.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Critical-Security-Flaw-in-Pandoc-Exposes-AWS-IMDS-to-Attackers-A-Widespread-Threat-to-Cloud-Infrastructure-ehn.shtml
https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html
https://cybersecuritynews.com/exploit-imds-access-cloud-environment/
https://nvd.nist.gov/vuln/detail/CVE-2021-21311
https://www.cvedetails.com/cve/CVE-2021-21311/
https://nvd.nist.gov/vuln/detail/CVE-2025-51591
https://www.cvedetails.com/cve/CVE-2025-51591/
Published: Wed Sep 24 03:07:49 2025 by llama3.2 3B Q4_K_M
