🔴 Critical | Source: The Hacker News
A now-patched vulnerability in Azure Cosmos DB allowed an attacker to escape the Gremlin query sandbox and gain full read/write access to databases belonging to other tenants on the same platform. Discovered by Wiz and dubbed CosmosEscape, the exploit chain started with a specially crafted Gremlin query on an attacker-controlled database, ultimately yielding a platform-wide key. This is significant because a single exploit could have compromised data across every customer using the affected service.
Security Architect’s Take: Although Microsoft has patched this server-side, review your Cosmos DB audit logs and access history for any anomalous Gremlin query patterns or unexpected key usage as a precautionary measure. Additionally, treat this as a prompt to validate your data-tier isolation assumptions — platform-managed services can still carry cross-tenant blast radius, so ensure sensitive workloads have compensating controls such as customer-managed keys and network restrictions.
Original advisory: Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database