Wiz Says ChaosDB Flaw Exposed Azure Cosmos DB Customer Keys
Summary
Wiz reported that flaws in Azure Cosmos DB’s notebook feature could expose customer primary keys and allow full database access. Microsoft disabled the feature and urged affected customers to rotate keys.
Key points
- Wiz says a series of misconfigurations in the Cosmos DB notebook feature enabled privilege escalation between customer notebooks without additional credentials.
- Researchers reported obtaining primary keys that could provide read, write, and delete access to affected Cosmos DB data.
- Wiz said the flaw could have affected thousands of customers, including Fortune 500 companies, and may have been exploitable for months or years.
- Microsoft disabled the vulnerable notebook feature within 48 hours of Wiz’s report; it remained off pending a security redesign.
- Microsoft notified more than 30% of Cosmos DB customers to manually rotate their access keys because they may have been exposed.
- Wiz advised that accounts using the notebook feature or created after January 2021 could be at risk, including accounts where the feature was enabled by default.
Article Details
- Vulnerability Types
- Privilege escalation between customer notebooks
- Cross-customer access to Cosmos DB primary keys
- Exploitation Status
- reported
- Exploit Availability
- none_reported
- Patch Status
- partial
- Workarounds
- Regenerate and rotate Cosmos DB primary access keys.
MITRE ATT&CK
People
Vendors
Products
Cosmos DBand two weeks ago we discovered an unprecedented breach that affects Azure’s flagship database service, Cosmos DB.Jupyter NotebookIn 2019, Microsoft added a feature called Jupyter Notebook to Cosmos DB that lets customers visualize their data and create customized views (see image below). The feature was automatically turned on for all Cosmos DBs