Critical Cosmos Database Flaw Affected Thousands of Microsoft Azure Customers

Cloud infrastructure security company Wiz on Thursday revealed
details of a now-fixed Azure Cosmos database vulnerability that
could have been potentially exploited to grant any Azure user full
admin access to other customers’ database instances without any
authorization.

The flaw, which grants read, write, and delete privileges, has
been dubbed “ChaosDB^[1],” with Wiz researchers
noting that “the vulnerability has a trivial exploit that doesn’t
require any previous access to the target environment, and impacts
thousands of organizations, including numerous Fortune 500
companies.”

Cosmos DB is Microsoft’s proprietary NoSQL database^[2]
that’s advertised as “a fully managed service” that “takes database
administration off your hands with automatic management, updates
and patching.”

The Wiz Research Team reported the issue to Microsoft on August
12, after which the Windows maker took steps to mitigate the issue
within 48 hours of responsible disclosure, in addition to awarding
a $40,000 bounty to the finders on August 17.

“We have no indication that external entities outside the
researcher had access to the primary read-write key associated with
your Azure Cosmos DB account(s),” Microsoft said in a statement.
“In addition, we are not aware of any data access because of this
vulnerability. Azure Cosmos DB accounts with a vNET or firewall
enabled are protected by additional security mechanisms that
prevent risk of unauthorized access.”

The exploit identified by Wiz concerns a chain of
vulnerabilities in the Jupyter Notebook feature of Cosmos DB,
enabling an adversary to obtain the credentials corresponding to
the target Cosmos DB account, including the Primary Key^[3], which provides access
to the administrative resources for the database account.

“Using these credentials, it is possible to view, modify, and
delete data in the target Cosmos DB account via multiple channels,”
the researchers said. As a consequence, any Cosmos DB asset that
has the Jupyter Notebook feature enabled is potentially
impacted.

Although Microsoft notified over 30% of Cosmos DB customers
about the potential security breach, Wiz expects the actual number
to be much higher, given that the vulnerability has been
exploitable for months.

“Every Cosmos DB customer should assume they’ve been exposed,”
Wiz researchers noted, adding, “we also recommend reviewing all
past activity in your Cosmos DB account.” Additionally, Microsoft
is also urging its customers to regenerate their Cosmos DB Primary
Keys to mitigate any risk arising from the flaw.