CosmosEscape: Taking over Every Database in Azure Cosmos DB
wiz.io14 points by uvuv 2 hours ago
14 points by uvuv 2 hours ago
It took them 6 months to fix this properly?
"Cosmos Master Key"... I can see why that would have been convenient, but talk about a footgun. Right out of a Marvel movie. Still, if admin backdoor access is business-necessary, is the answer a unique admin access key per account?
This is not the first time M$ “lost” their master key, it’s their tradition now
A critical vulnerability chain in Azure Cosmos DB enabled full read and write access to every Cosmos DB database.
Incredible that this is the second time Wiz has discovered a global Cosmos DB vulnerability (https://chaosdb.wiz.io/) and a shock that anyone is trusting Microsoft, Azure or in particular Cosmos DB with anything mission critical