Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials

Cloud security company Wiz revealed in-the-wild exploitation of a Linux utility flaw in Pandoc, tracked as CVE-2025-51591 (CVSS 6.5), used to target AWS Instance Metadata Service (IMDS) and steal EC2 IAM credentials. The vulnerability allows SSRF via crafted HTML iframe elements, enabling attackers to trick applications into querying IMDS and exfiltrating temporary credentials when an IAM role is attached to the instance.

Wiz researchers Hila Ramati and Gili Tikochinski described how an attacker could craft an HTML document with an iframe pointing to 169.254.169[.]254 to access sensitive paths such as /latest/meta-data/iam/info and /latest/meta-data/iam, though the attack was blocked by IMDSv2. The findings echo prior observations of credential theft attempts linked to SSRF against cloud environments, with Mandiant noting a history of such activity dating back to 2021.

The Hacker News advises organisations to enforce IMDSv2, as well as the principle of least privilege for instance roles, and to consider Pandoc’s sandbox or HTML sanitisation options to mitigate risk. Published on 24 September 2025, the report also highlights ongoing in-the-wild efforts to abuse SSRF flaws in other services.