Azure Cosmos DB Sandbox Escape Flaw Exposed Customer Data
A critical vulnerability in Azure Cosmos DB allowed attackers to bypass security controls and access databases across tenant boundaries. Microsoft has patched the issue after researchers demonstrated full read/write access.
TL;DR
- Wiz researchers discovered a sandbox escape flaw in Azure Cosmos DB's Gremlin API.
- The exploit allowed full read and write access to databases across customer tenants.
- Microsoft has released a patch to address the vulnerability.
- Organizations using Cosmos DB should verify their configurations and monitor for unusual activity.
- This highlights the importance of robust input validation in multi-tenant cloud services.
Researchers at Wiz have disclosed a serious security vulnerability in Microsoft's Azure Cosmos DB that could have led to unauthorized access across customer environments. The flaw, part of a broader exploit chain dubbed 'CosmosEscape,' affected the Gremlin query interface and enabled attackers to break out of its intended security sandbox.
By crafting malicious queries, threat actors could achieve code execution that granted them full read and write privileges to databases beyond their own tenant boundaries. This type of cross-tenant data exposure represents a significant risk in cloud-native platforms where isolation between customers is fundamental to trust models.
Technical Breakdown of the Exploit
- The vulnerability originated in the Gremlin query processing engine within Cosmos DB.
- Attackers used specially crafted queries to trigger unexpected behavior and escape the sandboxed environment.
- Once escaped, the exploit provided direct access to backend storage systems containing multiple tenant databases.
- No user interaction or additional privileges were required for successful exploitation.
Impact and Response
- Microsoft confirmed the issue and deployed a fix across all regions before public disclosure.
- Organizations are advised to review Cosmos DB configurations and audit logs for signs of compromise.
- Customers using the Gremlin API should ensure they're running updated service versions.
- Security teams should evaluate access patterns and implement enhanced monitoring for anomalous database interactions.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.