Researchers discover critical flaw in Azure Cosmos DB
A important flaw in Microsoft’s Azure Cosmos DB is putting 1000’s of firms at threat.
In a web site publish Thursday, Wiz protection scientists Nir Ohfeld and Sagi Tzadik detailed how they ended up able to get complete unrestricted access to the accounts and databases of quite a few thousand Microsoft Azure consumers, like Fortune 500 firms Coca-Cola and Exxon Mobil. The vulnerability, which they dubbed ChaosDB, influences Azure’s flagship databases support, Cosmos DB.
The story was initially reported by Reuters Friday right after Microsoft warned 1000’s of cloud consumers their databases might be uncovered. Exploiting the flaw could permit an attacker to steal the mystery keys of Cosmos DB consumers.
Ohfeld and Tzadik initially uncovered the flaw two months in the past, while on a routine search for new assault surfaces in the cloud. What they identified was a sequence of flaws in the CosmosDB element developed a loophole, “allowing any user to obtain, delete or manipulate a large assortment of industrial databases.” And according to the web site, exploiting it was trivial.
1st, Ohfeld and Tzadik accessed customers’ CosmosDB primary keys by exploiting a new assault vector identified in a element known as the Jupyter Notebook. The solution, as Wiz advises, is for consumers to transform their keys. Jupyter, a resource for organizing and presenting numbers in a databases, was additional to Cosmos DB in 2019 by Microsoft. In accordance to the web site, the element was routinely turned on for all Cosmos DBs this February.
“In brief, the notebook container authorized for a privilege escalation into other shopper notebooks,” Ohfeld and Tzadik wrote in the web site. “As a result, an attacker could get access to customers’ Cosmos DB primary keys and other remarkably sensitive secrets and techniques, this kind of as the notebook blob storage access token.”
From there, Ohfeld and Tzadik identified that an attacker could leverage the keys for entire admin access to all the data stored in the afflicted Cosmos DB accounts. Although they credited Microsoft’s protection workforce for having immediate motion to deal with the flaw, they also reported consumers might nonetheless be afflicted, since their primary access keys ended up likely uncovered.
SearchSecurity contacted Microsoft to obtain out how many consumers ended up afflicted, but the scope stays unclear.
“We mounted this problem instantly, to hold our consumers risk-free and protected. We thank the protection scientists for doing work underneath coordinated vulnerability disclosure,” a Microsoft spokesperson reported in an e mail to SearchSecurity.
Possible for long term affect
Microsoft has notified consumers who might have been afflicted by the vulnerability. A Wiz spokesperson informed SearchSecurity that Microsoft emailed three,three hundred Azure consumers. That’s more than 30% of Cosmos DB consumers, who ended up using the vulnerable entry place element for the duration of Wiz’s weeklong research period of time.
Jake Kouns, CEO and CISO at Chance Primarily based Protection, informed SearchSecurity that it is unconventional to have not specified Azure consumers more time to deal with the flaw right before publicly disclosing. “Now that they have developed this media consideration, it will probably guide to attackers making an attempt to look into and exploit this problem speedier,” he reported.
Although Microsoft says it has not witnessed proof that it is been exploited earlier, Wiz informed SearchSecurity that this is the variety of vulnerability a hacker could exploit without leaving considerably of a trace. Furthermore, the web site states the flaw has existed wherever from quite a few months to maybe years.
“It truly is remarkably probably that many, many more Cosmos DB consumers ended up afflicted,” a Wiz spokesperson reported in an e mail to SearchSecurity. “Simply because the probable exposure is so catastrophic in this situation, we’re encouraging all consumers to transform their access keys.”
Cloud vulnerabilities elevate one of a kind issues
The phone to consumers to deal with this problem tends to make this situation unconventional, Kouns informed SearchSecurity. Normally, with cloud vulnerabilities, the seller is required to put into action a deal with across its overall shopper base. Cloud vulnerabilities have extra aspects that make them one of a kind, in both equally good and destructive approaches.
The concept of monitoring vulnerabilities in the cloud has been long debated. Kouns reported monitoring vulnerabilities can be valuable in some approaches, but in other approaches it is a horrible concept because it aspects just what an attacker requirements to do. “More, a vast the vast majority of cloud/SaaS vulnerabilities must be patched by the support provider, not the shopper,” he reported.
In this situation, while it has been disclosed, the vulnerability has not been assigned a CVE. In a sequence of tweets about the Cosmos DB flaw, researcher Kevin Beaumont reported this is a large gap in cloud protection.
There is a large gap in cloud protection, by the way. No CVE numbers are issued for flaws, and suppliers aren’t required to disclose flaws. Cloud providers aren’t magically secure.
You will recognize community disclosure of this arrives from an external researcher.
— Kevin Beaumont (@GossiTheDog)
August 27, 2021
1 of the scientists involved in the Chaos DB disclosure was a former Microsoft worker who now works at Wiz. In accordance to Kouns, the vulnerability was managed as a bug bounty for which Microsoft paid out $40,000. This elevated a query for him pertaining to irrespective of whether any prior information obtained while doing work at Microsoft was employed. Furthermore, he questioned if there will be a transform in bounty applications that might exclude prior workers from having portion.
Jake Williams, CTO at BreachQuest, informed SearchSecurity an additional part the vulnerability highlights is the double-edged sword that is cloud computing. In accordance to Williams, when a vulnerability is learned in the default element in the platform, all deployed belongings are vulnerable. Hence, risk actors really don’t have to have to scan the world-wide-web looking for vulnerable circumstances they are all in one position. Nonetheless, there is an upside.
“As soon as the vulnerability is learned, it can commonly be swiftly patched,” Williams reported in a Twitter concept to SearchSecurity. “This suggests the window for exploitation is generally shorter than with on-premise deployments, but the affect can be higher. Thankfully, in this situation it appears protection scientists identified the vulnerability right before any risk actors did. We might not be so fortunate the upcoming time.”
SearchSecurity news writers Alexander Culafi and Shaun Nichols contributed to this posting.
