The IT Nerd

Wiz has disclosed that attackers are actively exploiting CVE-2025-51591, an SSRF flaw in the Linux utility Pandoc, to target AWS Instance Metadata Service (IMDS). The vulnerability allows attackers to abuse iframe rendering to extract IAM credentials from IMDSv1, potentially enabling access to AWS services like S3, RDS, and DynamoDB.

Wade Ellery, Chief Evangelist and IAM Strategy Officer, Radiant Logic has this to say:

     “What we have seen from the most recent breaches is that attackers keep finding ways to compromise account access.  Token hijacking, credential stuffing, phishing, and now iframe rendering to extract valid IAM credentials.  The conclusion we can draw is that the week link in the defenses remains the Authentication Layer.  Given the likelihood of a successful compromise at the AuthN layer the next line of defense is the Authorization Layer.  If an intruder gains access but is blocked from exploiting the compromised account, escalating privileges, or moving east to west then the attack is thwarted at the second wall.  Security is strongest when it is layered.  A robust, comprehensive, and real-time observability platform focused on identity data at the core of all Authorization decisions is critical to detect, obstruct, and remediate attacks that get past the Authentication layer.  The screen door has been proven vulnerable, this mandate a steal door backing it up to protect the enterprise.”

There are prevention tips that are in the Wiz article. They are worth implementing if you are affected by this.

From the “this is different” file comes this report by Wiz on thousands of hijacked websites in East Asia which are redirecting visitors to adult-themed sites:

The compromised websites include many owned by small companies and several operated by multinational corporations. They are diverse in terms of their tech stacks and hosting services, making it difficult to pinpoint any specific vulnerability, misconfiguration, or source of leaked credentials this threat actor may be abusing. In several cases, including a honeypot we set up to investigate this activity, the threat actor connected to the target web server using legitimate FTP credentials they somehow obtained previously.

While we were not able to determine how this threat actor has been gaining initial access to the affected web servers or where they are sourcing their stolen credentials from, we’ve decided to publish our findings regardless, in order to bring more awareness to this ongoing activity. Given the nature of the destination websites, we believe the threat actor’s motivations are most likely financial, and perhaps they intend to merely increase traffic to these websites from specific countries and nothing more. However, the impact to the compromised websites and their user experience is equivalent to defacement, and whatever weaknesses this actor is exploiting to gain initial access to these websites could be utilized by other actors to inflict greater harm.

Rui Ribeiro, CEO and Cofounder of Jscrambler had this comment:

     “This attack, which has compromised tens of thousands of websites aimed primarily at East Asian audiences and redirecting them to adult-themed content, highlights an often-overlooked security issue: securing the client-side experience at the moment the visitor is interacting with the website. In this case, the hacker injected malicious code into customer-facing web pages, collected information about the visitor, and hijacked their journey. This one incident underscores how important it is to understand the third-party JavaScript running on your browser and what data it is accessing. Not only is the customer experience tainted, but the compromised websites can face issues around data privacy, loss of revenue and reputation. Companies need visibility and control over the JavaScript that’s loaded into their web pages, whatever the source. Whether it’s a hijacking attack, data skimming or a simple configuration error, we must protect the interaction with each visitor.”

Now I just did a check my corporate website and I have FTP enabled. So I will be turning that off so that I am not a victim of this sort of attack. If you have a website, you might want to do the same thing to avoid being a victim as well.