Wiz says Azure Cosmos DB flaw could have exposed every database
Wiz says Microsoft fully remediated CosmosEscape, a Gremlin API vulnerability chain that reached a platform-wide signing secret.
By Ryan Merket · Published
Primary source: Wiz Research
Why it matters
CosmosEscape shows how one provider-side sandbox failure can bypass customer network controls when an internal service holds credentials with cross-tenant authority.
Wiz Research published a technical report about CosmosEscape, a vulnerability chain in Azure Cosmos DB's Gremlin API that it says could have allowed full read and write access to every database on the service. Microsoft said in a statement included in Wiz's report that it found no evidence of exploitation beyond Wiz's research and that no customer action is required.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.