3 ms·

CosmosEscape: Taking over Every Database in Azure Cosmos DB

74 points by uvuv 2mo ago

lateral_cloud 2mo ago
It took them 6 months to fix this properly?
- jasonvorhe 2mo ago
  It's Microsoft, of course. Their org chart basically dictates it.
- delfinom 2mo ago
  They patched the vulnerability within 2 days. They spent 6 months rearchitecting their backend. It's a major service for themselves and tens of thousands of customers, you don't vibe code yourself a new database query execution engine overnight.
- phatskat 2mo ago
  Considering that they had to rework things to not use the master key, I can understand the time and effort. From TFA, the DB Gateway handled all Cosmos requests, and used the master key to get an account’s private key and then forward the DB requests. If they had to rearchitect that gateway system, I’m sure it was no small task. Bear in mind, they probably approached this somewhat seriously since Cosmos powers lots of internal M$ tools like Teams and Copilot, not just customer applications.
- dointheatl 2mo ago
  Rejecting the premise: who says they fixed it properly?
uvuv 2mo ago
A critical vulnerability chain in Azure Cosmos DB enabled full read and write access to every Cosmos DB database.
troelsSteegin 2mo ago
"Cosmos Master Key"... I can see why that would have been convenient, but talk about a footgun. Right out of a Marvel movie. Still, if admin backdoor access is business-necessary, is the answer a unique admin access key per account?
- a012 2mo ago
  This is not the first time M$ “lost” their master key, it’s their tradition now
redwood 2mo ago
Incredible that this is the second time Wiz has discovered a global Cosmos DB vulnerability (https://chaosdb.wiz.io/ https://chaosdb.wiz.io/) and a shock that anyone is trusting Microsoft, Azure or in particular Cosmos DB with anything mission critical
sakisv 2mo ago
Is it me or was there a similar vulnerability reported a few years ago? Something about the attacker getting access to all platform's users' databases, though not sure if it was cosmos or something similar.
- ultra2d 2mo ago
  This one from a year ago? https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/ https://dirkjanm.io/obtaining-global-admin-in-every-entra-id... "This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments)."
  - sakisv 2mo ago
    oh ffs, I forgot about this. I was thinking of the other one though from 2021 mentioned in a sibling comment, and it was indeed, again, with cosmos
- chatmasta 2mo ago
  There have been a lot. I remember one that was essentially “send the request without an Authorization header.”
- FromOmelas 2mo ago
  Yes. you're thinking of https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...
gtowey 2mo ago
> Cosmos DB's engine translated Gremlin queries into .NET code, enforcing a set of restrictions designed to prevent queries from reaching beyond Gremlin operations. These restrictions, however, didn't sufficiently account for .NET reflection Wow, this is so unbelievably amateurish.
- deleted 2mo ago
  [deleted]
ryanschaefer 2mo ago
Not showing the actual query is somewhat disappointing
abkolan 2mo ago
Vaguely remember reading that ChatGPT uses CosmosDB, even ScottGu spoke about it.

74 points by uvuv 2mo ago

lateral_cloud 2mo ago

It took them 6 months to fix this properly?

jasonvorhe 2mo ago
It's Microsoft, of course. Their org chart basically dictates it.
delfinom 2mo ago
They patched the vulnerability within 2 days. They spent 6 months rearchitecting their backend. It's a major service for themselves and tens of thousands of customers, you don't vibe code yourself a new database query execution engine overnight.
phatskat 2mo ago
Considering that they had to rework things to not use the master key, I can understand the time and effort. From TFA, the DB Gateway handled all Cosmos requests, and used the master key to get an account’s private key and then forward the DB requests. If they had to rearchitect that gateway system, I’m sure it was no small task. Bear in mind, they probably approached this somewhat seriously since Cosmos powers lots of internal M$ tools like Teams and Copilot, not just customer applications.
dointheatl 2mo ago
Rejecting the premise: who says they fixed it properly?

uvuv 2mo ago

A critical vulnerability chain in Azure Cosmos DB enabled full read and write access to every Cosmos DB database.

troelsSteegin 2mo ago

"Cosmos Master Key"... I can see why that would have been convenient, but talk about a footgun. Right out of a Marvel movie. Still, if admin backdoor access is business-necessary, is the answer a unique admin access key per account?

a012 2mo ago
This is not the first time M$ “lost” their master key, it’s their tradition now

redwood 2mo ago

Incredible that this is the second time Wiz has discovered a global Cosmos DB vulnerability (https://chaosdb.wiz.io/ https://chaosdb.wiz.io/) and a shock that anyone is trusting Microsoft, Azure or in particular Cosmos DB with anything mission critical

sakisv 2mo ago

Is it me or was there a similar vulnerability reported a few years ago? Something about the attacker getting access to all platform's users' databases, though not sure if it was cosmos or something similar.

ultra2d 2mo ago
This one from a year ago? https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/ https://dirkjanm.io/obtaining-global-admin-in-every-entra-id... "This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments)."
- sakisv 2mo ago
  oh ffs, I forgot about this. I was thinking of the other one though from 2021 mentioned in a sibling comment, and it was indeed, again, with cosmos
chatmasta 2mo ago
There have been a lot. I remember one that was essentially “send the request without an Authorization header.”
FromOmelas 2mo ago
Yes. you're thinking of https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...

gtowey 2mo ago

> Cosmos DB's engine translated Gremlin queries into .NET code, enforcing a set of restrictions designed to prevent queries from reaching beyond Gremlin operations. These restrictions, however, didn't sufficiently account for .NET reflection Wow, this is so unbelievably amateurish.

deleted 2mo ago
[deleted]

ryanschaefer 2mo ago

Not showing the actual query is somewhat disappointing

abkolan 2mo ago

Vaguely remember reading that ChatGPT uses CosmosDB, even ScottGu spoke about it.