How to Find and Protect Azure Cosmos DB Accounts Affected by ChaosDB
Summary
Wiz outlines how to identify Cosmos DB accounts with Jupyter Notebooks enabled and mitigate ChaosDB exposure, including rotating primary keys, restricting network access, and moving toward RBAC and private endpoints.
Key points
- The vulnerability affected Cosmos DB accounts with Jupyter Notebook enabled and access from external IPs; the feature was automatically enabled for new accounts after February 2021.
- Microsoft disabled the vulnerable notebook service after Wiz reported the issue, but Wiz advised customers to regenerate potentially exposed primary keys.
- The article describes checking an Azure resource template for a notebookWorkspaces block to identify accounts with Jupyter Notebooks enabled.
- Rotate keys carefully: update applications to use the alternate key before regenerating the exposed primary key, then update applications with the new key.
- Restrict network access with specific firewall rules or virtual networks, and disable the exception allowing connections from public Azure datacenters where possible.
- Wiz recommends transitioning from shared primary and secondary keys to role-based access control and using private endpoints to reduce cross-account exposure.
Article Details
- Defense Focus
- Identify Cosmos DB accounts potentially affected by ChaosDB, rotate exposed primary keys, and reduce network exposure.
- Detection Methods
- In the Azure portal, export a Cosmos DB resource template and check for a block beginning with the resource type Microsoft.DocumentDB/databaseAccounts/notebookWorkspaces to determine whether Jupyter Notebook was enabled.
- Use the PowerShell commands described in the article to compare Cosmos DB accounts with log entries for key regeneration after 2021-08-26T12:30.
- Use Wiz Graph queries to identify Cosmos DB accounts with Jupyter Notebook enabled, assess effective exposure, and find high-risk accounts whose keys have not been rotated.
- Review Wiz cloud configuration reports for Cosmos DB network settings.
- Data Sources
- Azure Cosmos DB resource templates
- Azure activity logs queried with Get-AzLog
- Cosmos DB account and resource-group inventory queried with Get-AzCosmosDBAccount and Get-AzResourceGroup
- Wiz Graph resource and exposure data
- Cosmos DB cloud configuration reports
- Rule Types
- PowerShell commands for inventorying Cosmos DB accounts and checking key-regeneration logs
- Wiz Graph queries for Jupyter Notebook status, effective network exposure, and key-rotation status
- Platforms
- Azure portal
- Azure Cloud Shell
- Defensive Actions
- Regenerate the primary keys of affected Cosmos DB accounts, including accounts that are not publicly accessible; assess operational impact before rotation.
- Before regenerating a key, update applications to use the alternate key; after regeneration, update them to use the new key.
- Restrict network access with precise firewall rules and virtual networks, and use private endpoints where supported.
- Disable the firewall exception allowing connections from public Azure datacenters, while assessing potential disruption to Azure services.
- Transition from shared primary/secondary keys to RBAC-only authorization where feasible.
- Track key-rotation completion and monitor for accounts with broad internet exposure.
Vendors
Products
Azureour initial blog post on ChaosDB, the Wiz Research team found an unprecedented critical vulnerability in Azure Cosmos DB. The vulnerability gives any Azure user full admin access (read, write, delete) to anotherAzure Cosmos DBinitial blog post on ChaosDB, the Wiz Research team found an unprecedented critical vulnerability in Azure Cosmos DB. The vulnerability gives any Azure user full admin access (read, write, delete) to another customersWiz Threat CenterAnalyze the exposure – ChaosDB advisory at the Wiz Threat Center