IMDS ABUSED: HUNTING RARE BEHAVIORS TO UNCOVER EXPLOITS

Summary from the TLDR InfoSec newsletter

Wiz Research developed a data-driven threat hunting methodology to detect anomalous Instance Metadata Service (IMDS) usage by identifying processes that rarely access IMDS but suddenly query sensitive endpoints, such as IAM credentials, leading to the discovery of active exploitation of two zero-day SSRF vulnerabilities. The team uncovered CVE-2025-51591 in Pandoc (HTML-to-PDF conversion via malicious iframe tags) and a ClickHouse SSRF vulnerability where attackers abused SQL "SELECT * FROM url" functions to access cloud metadata services across AWS and GCP environments. This approach demonstrates how behavioral anomaly detection can reveal novel attack vectors targeting cloud infrastructure, emphasizing the importance of enforcing IMDSv2 and implementing least-privilege access controls to mitigate credential theft and lateral movement risks.