Cloud security firm Wiz has discovered active cyberattacks targeting Amazon Web Services (AWS) infrastructure through a vulnerability in Pandoc, a popular Linux document conversion utility. The attacks demonstrate how threat actors continue to evolve their methods for stealing cloud credentials and accessing sensitive systems.
## The Vulnerability: CVE-2025-51591
The security flaw, designated CVE-2025-51591 with a CVSS score of 6.5, is classified as a Server-Side Request Forgery (SSRF) vulnerability. Attackers exploit this weakness by injecting malicious HTML iframe elements into documents processed by Pandoc, allowing them to make unauthorized requests to internal systems.
## Target: AWS Instance Metadata Service
The primary target of these attacks is AWS’s Instance Metadata Service (IMDS), a critical component that provides running EC2 instances with essential information and temporary security credentials. IMDS operates through a special internal address (169.254.169.254) accessible only to applications running on the same instance.
When EC2 instances have associated Identity and Access Management (IAM) roles, IMDS provides temporary credentials that applications use to securely interact with other AWS services like S3, RDS, and DynamoDB. This design eliminates the need to store permanent credentials on machines, reducing security risks.
## How the Attack Works
Cybercriminals exploit SSRF vulnerabilities to trick applications into making requests to IMDS on their behalf. In the Pandoc case, attackers craft HTML documents containing iframe elements that point to the IMDS endpoint, attempting to extract sensitive credential information from paths like `/latest/meta-data/iam/info`.
“If the application can reach the IMDS endpoint and is susceptible to SSRF, the attacker can harvest temporary credentials without needing any direct host access,” explained Wiz researchers Hila Ramati and Gili Tikochinski.
## Real-World Impact
This isn’t merely a theoretical threat. Security firm Mandiant previously documented similar attacks by threat group UNC2903, which exploited SSRF vulnerabilities in database management tools to steal AWS credentials and conduct data theft operations dating back to 2021.
The attacks can have severe consequences, including:
– Cloud credential theft
– Network reconnaissance
– Unauthorized access to internal services
– Bypassing security controls like IP whitelists
## Defense Mechanisms Prove Effective
Fortunately, the recent Pandoc-based attacks were unsuccessful due to AWS’s implementation of IMDSv2, an enhanced version of the metadata service. Unlike the original IMDSv1, which operates on a simple request-response model, IMDSv2 requires session tokens and special headers, effectively blocking SSRF attacks.
Wiz observed these exploitation attempts from August through several weeks, indicating persistent attacker interest in this attack vector.
## Protection Strategies
Organizations can protect themselves through several measures:
**Immediate Actions:**
– Configure Pandoc with the `–sandbox` option when processing untrusted content
– Use the `-f html+raw_html` option to prevent iframe content inclusion
**Long-term Security:**
– Enforce IMDSv2 across all EC2 instances
– Implement the principle of least privilege for IAM roles
– Enable AWS GuardDuty for enhanced monitoring
– Regularly audit and update third-party software
## The Bigger Picture
These attacks highlight the ongoing evolution of cloud-focused cyber threats. As organizations increasingly migrate to cloud infrastructure, attackers adapt their techniques to target cloud-specific services and protocols. The combination of vulnerable third-party applications and cloud metadata services creates attractive opportunities for credential theft and lateral movement within cloud environments.
The incident underscores the importance of maintaining robust security practices across all components of cloud infrastructure, from the applications running on instances to the underlying cloud services they interact with.