Full Report
The cybersecurity spotlight hasn’t shifted from Microsoft for most of 2021. The latest in a string of critical security issues is a vulnerability in Microsoft Azure’s flagship Cosmos DB Database.
Analysis Summary
# Vulnerability: Azure Cosmos DB Jupyter Notebook Misconfiguration Leading to Key Exposure
## CVE Details
- CVE ID: Not explicitly provided in the text. (This refers to a specific security issue discovered by Wiz, likely tracked internally or with a specific advisory number, but no CVE is cited.)
- CVSS Score: Not provided. The impact suggests a *Critical* severity.
- CWE: Insecure Configuration/Misconfiguration (related to the Jupyter Notebook feature).
## Affected Systems
- Products: Microsoft Azure Cosmos DB Database.
- Versions: All instances utilizing the vulnerable Jupyter Notebook feature within Cosmos DB.
- Configurations: Any configuration where the Jupyter Notebook feature was enabled, which allowed privileged escalation paths.
## Vulnerability Description
The vulnerability stemmed from a series of misconfigurations within the Jupyter Notebook feature integrated into Microsoft Azure Cosmos DB, which is used for data visualization. These misconfigurations allowed an attacker to achieve privileged escalation into customer notebooks. Successful escalation led to the discovery of each customer's Cosmos DB primary key. Possession of the primary key grants full administrative access, including read, write, and delete capabilities over customer data collections.
## Exploitation
- Status: Remediation occurred before widespread discovery and exploitation by malicious actors ("This exposure was remediated before it was discovered and exploited by cyber attackers").
- Complexity: Implied to be relatively low given the description of "a series of misconfigurations" leading to key exposure.
- Attack Vector: Likely Network (accessing the misconfigured feature within the cloud environment).
## Impact
- Confidentiality: High (Full read access to underlying customer data collections).
- Integrity: High (Full write and manipulation access to customer data collections).
- Availability: High (Full delete access to customer data collections).
## Remediation
### Patches
- Microsoft disabled the vulnerable Jupyter Notebook feature within 48 hours of being reported by Wiz. Specific version patches are not detailed, as the immediate fix was feature disabling.
### Workarounds
- All impacted customers were urged to **create new primary keys** immediately, as the compromised keys could not be changed by Microsoft.
## Detection
- Detection methods for the initial vulnerability exploitation (gaining the key) are not detailed.
- General indicators would involve monitoring for unauthorized access to Cosmos DB primary keys or unusual access/modification patterns on customer data collections.
## References
- Vendor Advisory/Discovery Source: Wiz (hxxps://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-azure-customers-databases)
- Relevant Links: Article mentions other security issues affecting Microsoft during the same period (Power Apps exposure, ProxyShell, Print Spooler RCE), but these are separate from the Cosmos DB flaw.