CosmosEscape: How Wiz Researchers Uncovered a Critical Azure Cosmos DB Vulnerability
CosmosEscape: Taking over Every Database in Azure Cosmos DB
Our team at Wiz Research discovered CosmosEscape, a severe flaw in Azure Cosmos DB that allowed attackers to compromise every database in the service. By exploiting the Gremlin API, we identified a platform-wide secret we called the Cosmos Master Key, which enabled full takeover and enumeration of accounts. This vulnerability threatened Microsoft's internal services like Teams and Copilot. Microsoft has since fully remediated the issue without evidence of exploitation.
Cloud platforms are built in layers, and a vulnerability at the infrastructure tier can cascade upward to threaten the services built on top of it.
- gtowey
> Cosmos DB's engine translated Gremlin queries into .NET code, enforcing a set of restrictions designed to prevent queries from reaching beyond Gremlin operations. These restrictions, however, didn't sufficiently account for .NET reflection
Wow, this is so unbelievably amateurish.
- troelsSteegin
"Cosmos Master Key"... I can see why that would have been convenient, but talk about a footgun. Right out of a Marvel movie. Still, if admin backdoor access is business-necessary, is the answer a unique admin access key per account?
- lateral_cloud
It took them 6 months to fix this properly?