Nimbus — SSRF to IMDS Credential Theft, YAML Deserialization RCE, and Privileged Container Escape via core_pattern
An SSRF on a job scheduler leaks AWS IAM credentials from the instance metadata service. The stolen credentials give access to an SQS queue consumed by a worker doing unsafe YAML deserialization — yielding RCE inside a container. From there, a privileged CodeBuild container built with LocalStack is used to overwrite kernel's core_pattern and escape to root on the host.
