Vulnerability in Microsoft Azure Cosmos DB may have exposed customer data to hackers for years

guest · Aug 26, 2021

Vulnerability in Microsoft Azure Cosmos DB may have exposed customer data to hackers
August 26, 2021
https://siliconangle.com/2021/08/26...-cosmos-db-may-exposed-customer-data-hackers/

Microsoft Corp. has warned cloud customers that hackers may have potentially accessed their data via an exploitable vulnerability in its Azure cloud service.

Reuters first reported the news today, but the discovery of the vulnerability came from researchers at Wiz Inc. The vulnerability is in Microsoft Azure’s Cosmos DB product and isn’t that hard to access.
Click to expand...

The Wiz researchers discovered they could get access to keys that control access to thousands of companies. With those keys, they then had unfiltered access. Some of the customers include Coca-Cola Co., Exxon-Mobil Corp. and Citrix Systems Inc., among others.

“Database exposures have become alarmingly common in recent years as more companies move to the cloud and the culprit is usually a misconfiguration in the customer’s environment,” the Wiz researchers noted. “In this case, customers were not at fault.”
The issue lies with Microsoft and a series of flaws in an Azure Cosmos DB feature that creates a loophole, allowing any user to own, delete or manipulate commercial databases. In addition, the flaws also provide read/write access to the underlying architecture of Cosmos DB.
Click to expand...

The Wiz researchers have dubbed the vulnerability as #ChaosDB. They add that “exploiting it was trivial and required no other credentials.”
Click to expand...

guest · Aug 27, 2021

Microsoft Azure cloud vulnerability is the ‘worst you can imagine’
Thousands of Azure clients warned that data has been exposed for years
August 27, 2021
https://www.theverge.com/2021/8/27/22644161/microsoft-azure-database-vulnerabilty-chaosdb

Microsoft has warned thousands of its Azure cloud computing customers, including many Fortune 500 companies, about a vulnerability that left their data completely exposed for the last two years.

A flaw in Microsoft’s Azure Cosmos DB database product left more than 3,300 Azure customers open to complete unrestricted access by attackers. The vulnerability was introduced in 2019 when Microsoft added a data visualization feature called Jupyter Notebook to Cosmos DB. The feature was turned on by default for all Cosmos DBs in February 2021.

“This is the worst cloud vulnerability you can imagine,” said Ami Luttwak, Chief Technology Officer of Wiz, the security company that discovered the issue. “This is the central database of Azure, and we were able to get access to any customer database that we wanted.”
Click to expand...

Despite the severity and risk presented, Microsoft hasn’t seen any evidence of the vulnerability leading to illicit data access.

“There is no evidence of this technique being exploited by malicious actors,” Microsoft told Bloomberg in an emailed statement.
“We are not aware of any customer data being accessed because of this vulnerability.”
Microsoft paid Wiz $40,000 for the discovery, according to Reuters.
Click to expand...

Today’s issue is just the latest security nightmare for Microsoft.
But with the world’s data increasingly moving to centralized cloud services like Azure, today’s revelation could be the most troubling development yet for Microsoft.
Click to expand...

ronjor · Aug 27, 2021

Microsoft Azure Cosmos DB Guidance

Original release date: August 27, 2021
CISA is aware of a misconfiguration vulnerability in Microsoft’s Azure Cosmos DB that may have exposed customer data. Although the misconfiguration appears to have been fixed within the Azure cloud, CISA strongly encourages Azure Cosmos DB customers to roll and regenerate their certificate keys and to review Microsoft’s guidance on how to Secure access to data in Azure Cosmos DB.
Click to expand...

guest · Nov 11, 2021

ChaosDB: Researchers Share Technical Details of Azure Flaw
November 10, 2021
https://www.darkreading.com/cloud/chaosdb-researchers-share-technical-details-of-azure-flaw

Researchers who discovered a severe vulnerability in the Microsoft Azure Cosmos DB database solution today revealed the full extent of the flaws they found and previously undisclosed details of their investigation, which it turns out was far more extensive than first revealed.

But this wasn't the full story of Chaos DB, Wiz security researchers Sagi Tzadik and Nir Ohfeld said in their Black Hat talk today. The vulnerability did more than allow an unprivileged user to obtain complete, unrestricted access to databases of several thousand Azure customers.
By exploiting each misconfiguration in Cosmos DB, and chaining them together, the researchers were able to obtain many of Microsoft's internal Cosmos DB-related secrets and credentials.
Click to expand...

This was one of the reasons, Tzadik adds, that they held off on disclosing their full findings until now — to give the company sufficient time to mitigate the issue. Some of the information they could access was not only about Cosmos DB but about how Azure works.
Click to expand...

Log in or Sign up

Vulnerability in Microsoft Azure Cosmos DB may have exposed customer data to hackers for years

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

Log in or Sign up

Vulnerability in Microsoft Azure Cosmos DB may have exposed customer data to hackers for years

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

Useful Searches