Azure Cosmos DB Flaw Exposed Platform-Wide Access Key
A critical vulnerability in Azure Cosmos DB enabled attackers to escape the Gremlin query sandbox and gain full read/write access to multiple customer databases.
Why it matters
This flaw increased the risk of unauthorized cross-tenant access within Azure Cosmos DB, threatening data confidentiality and integrity across numerous customer environments.
SOC impact
Security teams should focus on identifying any unusual access or modification activity within Cosmos DB instances and verify whether their assets were affected by this sandbox escape vulnerability. Monitoring database query logs and access patterns is essential to detect potential exploitation.
Recommended actions
- Review Cosmos DB query logs for anomalous Gremlin activity
- Identify and inventory affected database instances
- Monitor for unexpected read or write operations across tenant databases
- Consult the vendor advisory for detailed vulnerability scope and remediation status
- Assess your environment for any signs of exploitation during the vulnerability timeframe
Executive Summary
A security researcher from Wiz identified a critical vulnerability in Azure Cosmos DB, named CosmosEscape, that allowed attackers to break out of the Gremlin query sandbox. This flaw enabled full read and write access across multiple customer databases hosted on the platform, representing a significant risk to data security. Microsoft has issued a patch addressing this issue. From an operational perspective, organizations using Azure Cosmos DB must assess the potential impact by reviewing query and access logs, focusing on suspicious cross-tenant interactions. Understanding the scope and timeline of exploitation is key to responding effectively and maintaining database security.
SOC Impact
Security teams should focus on identifying any unusual access or modification activity within Cosmos DB instances and verify whether their assets were affected by this sandbox escape vulnerability. Monitoring database query logs and access patterns is essential to detect potential exploitation.
Access and Activity Validation
- Review Cosmos DB query logs for anomalous Gremlin activity
- Identify and inventory affected database instances
- Monitor for unexpected read or write operations across tenant databases
- Consult the vendor advisory for detailed vulnerability scope and remediation status
- Assess your environment for any signs of exploitation during the vulnerability timeframe
Why It Matters
This flaw increased the risk of unauthorized cross-tenant access within Azure Cosmos DB, threatening data confidentiality and integrity across numerous customer environments.