Anomalous IMDS Access Uncovers Exploited Pandoc and ClickHouse SSRF Paths
Summary
Wiz researchers describe hunting for anomalous cloud metadata access that uncovered exploitation of a Pandoc zero-day (CVE-2025-51591) and SSRF abuse in ClickHouse. IMDSv2 and limited instance privileges reduced impact.
Key points
- Researchers established a baseline of common IMDS-using processes, then investigated rare access to sensitive metadata paths and prioritized findings using compute context.
- Anomalous Pandoc access led researchers to CVE-2025-51591, an SSRF vulnerability involving HTML-to-PDF conversion and crafted iframe elements.
- The Pandoc attack targeted AWS metadata endpoints, but IMDSv2 rejected the iframe’s stateless GET requests because they could not obtain a session token.
- Researchers found ClickHouse SSRF abuse in a GCP environment, where a misconfigured URL-query feature could access IMDS and read sensitive instance data.
- The ClickHouse case was limited by the instance’s lack of sufficiently privileged credentials; researchers warn that access to sensitive cloud resources could make the same exposure more serious.
- The article recommends enforcing IMDSv2, applying least privilege, and monitoring for unexpected processes and sensitive-path access.
Article Details
- Attack Vectors
- Crafted HTML containing an <iframe> that targets the AWS Instance Metadata Service (IMDS) can exploit the Pandoc SSRF vulnerability CVE-2025-51591 to request sensitive metadata paths. In the reported case, enforced IMDSv2 prevented the stateless iframe requests from obtaining credentials.
- Misconfigured ClickHouse instances that allow unauthenticated users to query arbitrary URLs using SELECT * FROM url can be abused for SSRF to access IMDS and read instance-provided data. The reported GCP instance lacked credentials with sufficient privileges to cause significant damage.
- More broadly, vulnerable applications or misconfigured workloads can be manipulated into querying IMDS, potentially exposing temporary credentials for lateral movement or privilege escalation.
- Defensive Notes
- Enforce IMDSv2 where possible; its session-token requirement blocked the reported Pandoc iframe-based requests.
- When converting untrusted HTML with Pandoc, use the documented sandbox or raw_html flags.
- Restrict ClickHouse arbitrary-URL querying, including access to the READ ON URL feature, especially for unauthenticated users.
- Apply least-privilege permissions to instance roles and limit workload network access to reduce the impact of IMDS exposure.
- Monitor for unusual IMDS access by processes that do not normally use it, particularly requests to sensitive metadata paths, and use runtime and compute-context telemetry to investigate.
MITRE ATT&CK
CVE
People
Vendors
Amazon Web Servicesto securely access cloud services without needing to hardcode credentials on the machine. While Azure and AWS call this service IMDS, in GCP it’s known as the VM metadata service.WizThe Wiz Research team continuously monitors trends across the threat landscape using Wiz Defend’s threat detection rules. Our goal is to track attacker tradecraft (TTPs) as it evolves, so we can rapidly adapt defenses
Products
ClickHouseReal-World Finding 2: Clickhouse SSRFPandocReal-World Finding 1: Pandoc SSRFWiz CSPMWiz CSPM and Cloud Configuration Monitoring: Wiz continuously monitors your cloud configurations to identify instances that might be vulnerable to IMDS exploitation, such as those with overly permissive network accessWiz DefendThe Wiz Research team continuously monitors trends across the threat landscape using Wiz Defend’s threat detection rules. Our goal is to track attacker tradecraft (TTPs) as it evolves, so we can rapidly adapt defensesWiz Runtime SensorWiz Runtime Sensor: The Wiz Runtime Sensor detects real-time events and behaviors associated with anomalous IMDS usage, alerting you to suspicious activity as it happens. This includes: