Full Report
The cybersecurity spotlight hasn’t shifted from Microsoft for most of 2021. The latest in a string of critical security issues is a vulnerability in Microsoft Azure’s flagship Cosmos DB Database.
Analysis Summary
# Vulnerability: Critical Misconfiguration in Azure Cosmos DB Leading to Database Key Exposure (ChaosDB)
## CVE Details
* **CVE ID:** Not explicitly provided in the text for this specific Cosmos DB flaw.
* **CVSS Score:** Not explicitly provided, but described as "critical."
* **CWE:** Related to improper access control or security misconfiguration.
## Affected Systems
* **Products:** Microsoft Azure Cosmos DB Database.
* **Versions:** Impacted customers utilizing the feature that bundled authentication credentials with a Jupyter Notebook service. The specific version range is not listed.
* **Configurations:** Customers using the Jupyter Notebook feature integrated within Cosmos DB for data visualization.
## Vulnerability Description
The vulnerability stemmed from a series of misconfigurations within a Cosmos DB feature that integrated Jupyter Notebooks for data visualization. These misconfigurations allowed for privileged escalation into customer notebooks. Successful escalation led to the discovery of each customer's Cosmos DB primary key, granting the attacker full read, write, and delete access to the underlying customer data and database collections.
## Exploitation
* **Status:** Remediation occurred **before** discovery and exploitation by cyber attackers. (Implies no public exploitation reported at the time of the article.)
* **Complexity:** Medium (Required escalation into customer notebooks to find the key).
* **Attack Vector:** Network (Access to the Azure environment).
## Impact
* **Confidentiality:** High (Full read access to customer commercial databases).
* **Integrity:** High (Ability to delete or manipulate mass collections of data).
* **Availability:** High (Ability to delete data).
## Remediation
### Patches
* Microsoft disabled the vulnerable Jupyter feature within 48 hours of being notified by Wiz. *No specific patch version is listed.*
### Workarounds
* All impacted customers were urged to **create new primary keys** for their Cosmos DB instances, as the original compromised keys could not be changed by Microsoft.
## Detection
* **Indicators of Compromise:** Unauthorized access or unusual activity originating from or targeting the Jupyter Notebook integration within Cosmos DB environments.
* **Detection methods and tools:** Monitoring and auditing access patterns for the Cosmos DB primary keys.
## References
* [Vendor advisory (Wiz blog post detailing the discovery - defanged)](https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-azure-customers-databases)