Wiz Uncovers Active Exploitation of Pandoc Vulnerability Targeting AWS EC2

Cloud security firm Wiz has reported active exploitation of a vulnerability in Pandoc, a Linux utility, as part of attacks targeting Amazon Web Services (AWS) Instance Metadata Service (IMDS).

The flaw, tracked as CVE-2025-51591 with a CVSS score of 6.5, is a Server-Side Request Forgery (SSRF) issue that lets attackers compromise systems by injecting a malicious HTML iframe.

AWS EC2 IMDS plays a key role in cloud operations, providing details about running instances and issuing temporary credentials when an IAM role is linked to the instance.

These temporary credentials allow applications to securely access AWS services such as S3, RDS, and DynamoDB without storing them locally, reducing the risk of accidental leaks.

Attackers, however, can abuse SSRF vulnerabilities in web applications to obtain IAM credentials from IMDS. In such cases, the attacker manipulates the application on an EC2 instance into requesting credentials from the metadata service on their behalf.

An attacker aiming to compromise AWS environments can exploit SSRF flaws in web applications hosted on EC2 instances. Once such a vulnerability is found, they can query the instance metadata to extract IAM credentials. This is a proven, real-world threat.

In fact, as early as 2022, Google-owned Mandiant reported that the threat group UNC2903 had been abusing IMDS credentials since July 2021. The attackers leveraged an SSRF bug (CVE-2021-21311, CVSS score: 7.2) in Adminer, an open-source database management tool, to infiltrate AWS environments and exfiltrate data.

The underlying risk lies in the design of IMDSv1, which relies on a simple request–response model, making it a prime target when vulnerable web applications are deployed alongside it.

Organizations are advised to enable IMDSv2 on all EC2 instances and assign roles that strictly adhere to the principle of least privilege (PoLP), helping minimize the potential impact if IMDS is compromised.