# IMDS Abused: Hunting Rare Behaviors to Uncover Exploits

Pandoc renders <iframe> tags during HTML-to-PDF conversion, enabling SSRF to AWS IMDS; exploited in the wild but blocked by IMDSv2.

- Payout: Real-world hack
- Severity: high
- Program: Pandoc
- Credited: Wiz Research
- Disclosed: 2025-09-22
- CVE: CVE-2025-51591
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/imds-anomaly-hunting-zero-day
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-imds-anomaly-hunting-zero-day
- Tags: domain:cloud impact:internal-access kind:incident platform:threat-intel sev:high tech:aws technique:recon technique:source-review vuln:misconfiguration vuln:ssrf

**Target:** HTML-to-PDF conversion in a web service using pandoc
**Root cause:** Pandoc renders <iframe> tags in untrusted HTML without the raw_html or sandbox flags, letting attacker-supplied src attributes trigger server-side requests to internal endpoints like 169.254.169.254.
**Steps:**
1. Submit HTML document containing `<iframe src="http://169.254.169.254/latest/meta-data/iam/info">` to a service converting HTML to PDF via pandoc
2. Pandoc renders the iframe, issuing a GET to the IMDS endpoint
3. Read rendered PDF to exfiltrate metadata response
4. Repeat against `/latest/meta-data/iam/security-credentials/` to harvest credentials (blocked if IMDSv2 enforced)
**How found:** Wiz runtime telemetry baseline showed pandoc (a markup converter) accessing sensitive IMDS paths in <2% of environments where present; anomaly triggered investigation leading to a GitHub issue on pandoc iframe SSRF.
**Exploitation:** Attacker submitted crafted HTML with iframe src pointing at AWS IMDS sensitive paths; the service's pandoc conversion fetched them server-side. IMDSv2 token requirement rejected the stateless GETs, so no credentials were obtained; only internal servers were reachable.
**Insight:** Baseline which processes normally touch IMDS, then alert on rare processes hitting sensitive metadata paths like /iam/info — document converters and other file-processing tools are prime SSRF vectors when they render embedded resources.