Original Issue Date August 27, 2021
Severity Rating High
Software Affected
Microsoft Azure Cosmos DB
Overview
It has been reported that there is a critical vulnerability in the Microsoft Azure cloud platform’s Cosmos DB that wrongly allows any Azure user full administrative access rights (read, write, delete etc.) to other customers’ Cosmos DB instances without any authorization.
Description
The vulnerability in Azure Cosmos DB allows a user to gain access to another customer’s resources by using the account’s primary read-write key. The vulnerability exists due to series of misconfigurations in the Jupyter Notebook web application, a data visualisation tool, in Cosmos DB, which an attacker can exploit to obtain credentials to the NoSQL database system. The application fails to properly impose security restrictions in the Azure Cosmos DB, which leads to security restrictions bypass and privilege escalation. Therefore, an attacker could gain access to user’s Cosmos DB primary keys and other highly sensitive information such as the notebook blob storage access token.
Successful exploitation of this vulnerability could allow any user to download, delete or manipulate the collection of databases of the vulnerable system.
Solution
Users are advised to immediately regenerate the Cosmos DB Primary Keys:
Disclaimer
The information provided herein is on “as is” basis, without warranty of any kind.