ChaosDB Flaws Could Expose Azure Cosmos DB Accounts and Internal Management Panels
Summary
Wiz researchers say a chain of Cosmos DB misconfigurations enabled access to thousands of customer databases and more than 100 internal management panels. Microsoft mitigated the issue within 48 hours of receiving the report.
Key points
- Wiz researchers said flaws associated with Cosmos DB’s Jupyter Notebook feature could enable local privilege escalation and unrestricted network access.
- The researchers said certificates and private keys obtained through the flaw chain provided admin access to customer Cosmos DB accounts.
- They also reported accessing more than 100 Cosmos DB-related Service Fabric management panels and obtaining account information, including authentication tokens.
- Wiz said the Notebook feature was enabled by default on Cosmos DB accounts, leaving customers exposed without their knowledge.
- The researchers said the access could have enabled broader service disruption; they characterized this as a potential service takeover.
- Microsoft reportedly mitigated the vulnerability within 48 hours of receiving Wiz’s report; the article says customers still had to take manual steps to be fully mitigated.
Article Details
- Vulnerability Types
- Misconfigurations in the Cosmos DB Jupyter Notebook feature that enabled local privilege escalation and unrestricted network access, exposing certificates and private keys
- Severity
- Severe; the researchers report that the flaws could enable unrestricted access to customer databases and access to internal service management panels.
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
Vendors
Products
Azure Cosmos DBIn August, 2021 the Wiz Research Team disclosed ChaosDB – a severe vulnerability in the popular Azure Cosmos DB database solution that allowed for complete, unrestricted access to the accounts and databases of severalService Fabricwere able to authenticate, as admin, to over 100 Cosmos DB-related management panels (in the form of Service Fabric instances, which is the container orchestration solution being used behind the scenes to power the