Microsoft has revealed that thousands of Azure Cosmos DB database users may need to update their security protections after a serious flaw was discovered.
Cosmos DB is Microsoft’s database service that runs atop its Azure cloud computing platform, and is used by various Fortune 500 companies all around the world.
Cybersecurity researchers from cloud infrastructure security company Wiz discovered a series of flaws in one of the features of the database service, which could be exploited by threat actors to gain complete control over a database, meaning they could read or even delete data.
- We’ve rounded up the best cloud databases on the market
- These are the best endpoint protection tools
- Also check our list of the best cloud hosting on the market
“Every CISO’s nightmare is someone getting their access keys and exfiltrating gigabytes of data in one fell swoop. So you can imagine our surprise when we were able to gain complete unrestricted access to the accounts and databases of several thousand Microsoft Azure customers, including many Fortune 500 companies,” write Wiz’s Nir Ohfeld and Sagi Tzadik in a joint blog post.
Keyless entry
The security researchers note that exploiting the vulnerability, which they’ve named ChaosDB, was “trivial.”
The vulnerability exists in the Jupyter Notebook feature that helps users visualize their data. It was introduced in 2019 and was automatically enabled for all Cosmos DB databases in February 2021.
Without giving out too many details, the researchers note that Jupyter’s implementation gave attackers access to the database’ primary keys and other highly sensitive secrets such as its blob storage access token.
Exploiting these details keys, the researchers were able to access and exercise full read/write/delete control over the database from across the internet.
On being notified by the researchers, Microsoft quickly disabled the vulnerable notebook feature to prevent leaking secrets. The company is also asking a section of its users to rotate their keys to ensure that any keys that have already been exfiltrated by unauthorized users are rendered useless.
According to Reuters, Microsoft's email highlighted the fact that the company had found no evidence to suggest that the flaw had been exploited.
- Check our list of the best cloud computing services right now
Via Reuters
