Wiz Research Finds Critical Vulnerability in Azure Cosmos DB

Wiz Research discovered a critical vulnerability in the Azure Cosmos DB Gremlin API that could allow attackers to access all customer databases ^[1].

The flaw, named CosmosEscape, represents a significant security risk because it allowed for the extraction of a platform-wide signing key. This key effectively acted as a master pass, providing unrestricted read and write access to any database hosted on the service ^[2].

Researchers found that the vulnerability existed within the Gremlin sandbox. By escaping this sandbox, an attacker could retrieve the account signing key from the gateway ^[3]. Once the key was obtained, the attacker could bypass standard security barriers to interact with the data of other users ^[4].

This security gap potentially affected thousands of cloud users ^[5]. Because the signing key is used to verify the identity of requests, its compromise would allow an unauthorized party to impersonate the service itself, granting them total control over the targeted databases ^[2].

Microsoft has since addressed the issue. The company said it found no evidence of unauthorized activity outside the testing conducted by Wiz Research ^[6]. However, the theoretical impact remained severe, as the flaw could have allowed attackers to compromise all Azure Cosmos DB databases ^[7].

The discovery highlights the risks associated with sandbox escapes in cloud environments. When a flaw allows a user to break out of a restricted execution environment, it can expose the underlying infrastructure and the credentials used to manage multiple tenants ^[3].