Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-51591
CVE-2025-51591:
Linux Debian vulnerability analysis and mitigation
Overview
CVE-2025-51591 is a Server-Side Request Forgery (SSRF) vulnerability in JGM Pandoc affecting version 3.6.4 (and earlier versions that process untrusted HTML). It allows network-based attackers to cause the Pandoc process to fetch arbitrary internal or external URLs by injecting a crafted <iframe> element into HTML input. The vulnerability was discovered by Harel Levy in May 2025 and disclosed via a GitHub issue (jgm/pandoc#10682) filed by RealestName on March 12, 2025; it was published to NVD on July 11, 2025 (Pandoc Issue #10682, Vulnerability Research). The CVSS v3.1 base score is 3.7 (Low), reflecting high attack complexity and limited confidentiality impact with no integrity or availability impact (Red Hat Advisory). Despite the low CVSS score, real-world exploitation has been documented targeting high-value cloud metadata endpoints.
Technical details
The root cause is CWE-918 (Server-Side Request Forgery): when Pandoc reads HTML input, its HTML reader (Text/Pandoc/Readers/HTML.hs, lines 513–537) automatically fetches the content of <iframe src="..."> elements from the specified local file or URL (Pandoc Commit 67edf7c, Pandoc Discussion #11200). An attacker who can supply untrusted HTML to a server-side Pandoc invocation (e.g., an "Export to PDF" feature) can embed <iframe src="http://169.254.169.254/latest/meta-data/"> to cause the server process to make outbound HTTP requests to internal services, including cloud instance metadata endpoints (Pandoc Issue #10682). No authentication or user interaction is required beyond the ability to submit HTML content for processing. The Pandoc maintainer considers this a misuse scenario rather than a code defect, noting that the --sandbox option or pandoc-server mode prevents the behavior (Pandoc Discussion #11200).
Impact
Successful exploitation allows an attacker to make the Pandoc server process issue HTTP requests to internal network resources, including cloud provider Instance Metadata Services (IMDS). Real-world attacks have been documented where threat actors targeted the AWS IMDS endpoint (http://169.254.169.254/) to retrieve EC2 IAM role credentials, enabling complete cloud infrastructure compromise and lateral movement within AWS environments (The Hacker News, Wiz Blog). The primary impact is confidentiality loss — stolen IAM credentials can be used to access S3 buckets, invoke Lambda functions, escalate privileges, and pivot to other cloud services. Integrity and availability are not directly impacted by the SSRF itself, but downstream abuse of stolen credentials can affect all three pillars.
Exploitation steps
- Reconnaissance: Identify web applications that accept user-supplied HTML and use Pandoc server-side for document conversion or PDF generation (e.g., "Export to PDF" features, document editors, report generators).
- Craft malicious HTML payload: Construct an HTML document containing an
<iframe>element pointing to the target internal resource, such as the AWS IMDS endpoint:<html><body><iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/"></iframe></body></html> - Submit payload: Upload or submit the crafted HTML to the vulnerable application's document conversion endpoint. Ensure no whitespace exists between the
<iframe>open and close tags, as Pandoc may not fetch the URL otherwise (Pandoc Discussion #11200). - Trigger Pandoc processing: The application invokes Pandoc (without
--sandbox) to convert the HTML. Pandoc's HTML reader fetches theiframe srcURL, causing the server to make an HTTP request to the IMDS endpoint. - Retrieve credentials: The IMDS response (containing IAM role name and temporary credentials) is embedded in the Pandoc output document. The attacker retrieves the output and extracts
AccessKeyId,SecretAccessKey, andTokenvalues. - Abuse credentials: Use the stolen IAM credentials with AWS CLI or SDK to access cloud resources, escalate privileges, exfiltrate data from S3, or pivot laterally within the cloud environment (The Hacker News, Wiz Blog).
Indicators of compromise
- Network: Outbound HTTP requests from the Pandoc server process to
http://169.254.169.254/(AWS IMDS) or other internal RFC-1918 addresses; unexpected HTTP GET requests to cloud metadata endpoints in server-side application logs. - Logs: Application logs showing Pandoc invocations processing user-supplied HTML followed by unusual outbound connections; AWS CloudTrail logs showing IAM credential usage from unexpected IP addresses or regions shortly after a document conversion event.
- AWS-Specific:
GetCallerIdentityorAssumeRoleAPI calls using EC2 instance role credentials from external IP addresses; unusual API activity (S3 ListBuckets, EC2 DescribeInstances) from the instance's IAM role originating outside the instance. - Process: Pandoc process making network connections to non-standard destinations (observable via
netstat,ss, or EDR telemetry); child processes or network activity inconsistent with normal document conversion workflows (The Hacker News, Wiz Blog).
Mitigation and workarounds
The Pandoc maintainer does not consider this a code defect and has addressed it by updating the Security section of the Pandoc manual rather than issuing a code patch (Pandoc Commit 67edf7c, Pandoc Discussion #11200). Fedora has issued updated pandoc-cli packages addressing this CVE (Linux Security Fedora Advisory). Recommended mitigations include:
- Use
--sandboxflag: Run Pandoc with--sandboxto restrict network and file system access during processing. - Use
pandoc-server: Deploypandoc-serverinstead of the CLI, as it is automatically sandboxed. - Use
-f html+raw_html: Pass-f html+raw_htmlto cause<iframe>elements to be treated as raw HTML blocks rather than fetched (note: this may re-enable SSRF via wkhtmltopdf if that PDF engine is used). - Enable IMDSv2: Configure AWS EC2 instances to require IMDSv2 (token-based) requests, which prevents simple HTTP GET requests to the metadata service from succeeding.
- Avoid processing untrusted HTML: Implement input validation to strip or reject
<iframe>elements before passing content to Pandoc.
Community reactions
The Pandoc maintainer (jgm) publicly disputed the CVE's validity, stating: "Both CVEs, in my view, are spurious. If they are not spurious, we need CVEs for cat, echo, and curl too" — arguing that SSRF via Pandoc is a misuse scenario, not a software defect, and that the manual already documents required precautions (Pandoc Discussion #11200). A CISA representative (CSMurray-CISA) opened a GitHub discussion on October 6, 2025 requesting patch information, and another CISA researcher (amanion-cisa) initially theorized the CVE might be a duplicate of CVE-2022-35583 (wkhtmltopdf), though jgm confirmed Pandoc itself fetches iframe content independently (Pandoc Discussion #11200). The vulnerability received significant media coverage after real-world exploitation was reported, with The Hacker News, SC World, GBHackers, and multiple security blogs covering the AWS IMDS credential theft angle (The Hacker News, SC World). Community sentiment on Reddit and Mastodon was mixed, with some researchers noting the low CVSS score understates real-world risk given the cloud credential theft impact.
Additional resources
- Pandoc Issue #10682 — Original SSRF issue report
- Pandoc Discussion #11200 — Patch discussion with maintainer
- Pandoc Commit 67edf7c — Security manual update
- PoC Repository — Public proof-of-concept exploit
- Vulnerability Research — Original researcher write-up
- The Hacker News — In-the-wild exploitation report
- Wiz Blog — IMDS anomaly hunting and cloud impact analysis
Source: This report was generated using AI
Related Linux Debian vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management