Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials
According to cloud security firm Wiz, it discovered that a Linux application named Pandoc had a security issue that was being exploited in the field as part of attacks intended to compromise Amazon Web Services' (AWS) Instance Metadata Service (IMDS).
CVE-2025-51591 (CVSS score: 6.5) is the vulnerability in question. It is a case of Server-Side Request Forgery (SSRF), which enables attackers to compromise a target system by inserting a specially constructed HTML iframe element.
An essential part of the AWS cloud environment, the EC2 IMDS provides details on instances that are currently running as well as temporary, short-lived credentials if the instance is linked to an identity and access management (IAM) role. Any application running on an EC2 instance can access the instance meta...