AWS Attack Abusing XXE for SSRF: Access EC2 Instance Metadata (IMDSv1) and Steal IAM Role Credentials January 24, 2026