Summary
Azure's Cosmos DB database service was vulnerable to remote account takeover.
Any Azure user could gain full admin access to other customers' Cosmos DB instances without authorization.
The vulnerability had a trivial exploit that doesn't require any previous access to the target environment.
Affected Services
Cosmos DB
Remediation
Regenerate primary read/write key.
Tracked CVEs
No tracked CVEs
References
https://chaosdb.wiz.io/https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-azure-customers-databaseshttps://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough
Contributed by https://github.com/0xdabbad00
Entry Status
Finalized
Disclosure Date
Mon, Aug 9th, 2021
Exploitablity Period
2017 - 2021
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
8.93
(PI:1.5/A1:22/A2:1/A7:1.1/A8:1)
Discovered by
Nir Ohfeld, Sagi Tzadik, Wiz
