Critical CosmosEscape Vulnerability Exposes Azure Cosmos DB to Potential Attacks

Wiz Research disclosed a critical vulnerability named CosmosEscape in Azure Cosmos DB, allowing attackers to potentially compromise every database in the service, including Microsoft's internal systems like Entra ID, Teams, and Copilot. The flaw, residing in the Gremlin API, could have enabled attackers to acquire the Cosmos Master Key, granting full read and write access to databases. This vulnerability posed a significant risk of cross-tenant attacks, potentially impacting millions of workloads. Microsoft has since remediated the issue by eliminating the Cosmos Master Key and has confirmed no evidence of exploitation. Security experts emphasize the importance of reviewing security postures despite the patch, as traditional tools may not detect such vulnerabilities. The incident serves as a reminder of the inherent risks in shared cloud infrastructure.

Key Points: • CosmosEscape vulnerability could compromise all databases in Azure Cosmos DB. • Attackers could acquire the Cosmos Master Key, enabling full access to databases. • Microsoft has remediated the issue, but organizations should review their security measures.