A significant security flaw named CosmosEscape was discovered in Microsoft Azure Cosmos DB, potentially allowing attackers to control numerous databases hosted on the service, including Microsoft’s own systems.
Discovery of the CosmosEscape Vulnerability
The vulnerability was located in the Gremlin API of Cosmos DB. If exploited, it could have facilitated cross-tenant attacks affecting countless customer workloads and Microsoft’s internal infrastructure. Understanding these risks is crucial for evaluating cloud platform security in multi-tenant enterprise setups.
Researchers from Wiz identified this flaw while working with Gremlin, a graph query language supported by Cosmos DB. An unusual .NET exception hinted that Cosmos DB employed a custom .NET-based Gremlin engine, differing from the typical Java Virtual Machine (JVM) implementations.
Exploiting the Gremlin Engine
This discovery was pivotal as Gremlin servers usually compile queries into executable code within a restricted sandbox, historically vulnerable to attacks. The researchers found that the engine translated Gremlin queries into .NET code without adequately restricting .NET reflection, allowing code to inspect and manipulate other code at runtime.
By leveraging this gap, researchers crafted queries that enabled file read, file write, and complete arbitrary code execution. A proof of concept involved a Gremlin query executing the hostname command on Cosmos DB’s backend infrastructure.
Potential Impact and Mitigation
This execution granted researchers access to the DB Gateway, tasked with executing customer queries. Despite customer databases being on separate clusters, the Gateway accessed them via a signing key capable of retrieving any account’s primary key.
This key, known as the Cosmos Master Key, was not limited to a single customer or region and worked across various API formats. It unlocked access to the Config Store, a directory listing every account on the platform.
Using the Config Store, attackers could have enumerated every account in a region or targeted specific organizations by filtering results by tenant ID. Combining sandbox escapes and unscoped signing keys bypassed fundamental cloud isolation barriers.
Resolution and Future Outlook
Wiz disclosed CosmosEscape to Microsoft, which swiftly released a hotfix and eliminated the Cosmos Master Key, enhancing architectural safeguards. Microsoft confirmed no malicious exploitation occurred before the disclosure, and no customer action is necessary.
This incident highlights the importance of continuous security audits and monitoring for unexpected access patterns in cloud environments. Security teams must remain vigilant to protect critical data stores from similar threats.
