3 ms·
Remember when cosmosdb users could read other users databases? [0] It was so boneheadedly stupid, it was like a sysadmin making all user directories readable b
by prepend 3y ago
Remember when cosmosdb users could read other users databases? [0]
It was so boneheadedly stupid, it was like a sysadmin making all user directories readable by all users. Not sure how that would not be tested. And made me worry about what other vulnerabilities lurk in Azure.
[0] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...
- insanitybit 3y agoThe vulns from wiz were so bad I basically wrote off Azure that day. And not bad like 'impact is high', bad like 'did anyone in your massive security org actually look at this?'.
- chayesfss 3y ago[dead]