Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CosmosEscape: Taking over Every Database in Azure Cosmos DB

wiz.io

Post reply on HN
Print view View original

11–19 of 19 posts

Re: CosmosEscape: Taking over Every Database in Azure Cosmos DB

#11

Post by [deleted] »

gtowey wrote: post #9

> Cosmos DB's engine translated Gremlin queries into .NET code, enforcing a set of restrictions designed to prevent queries from reaching beyond Gremlin operations. These restrictions, however, didn't sufficiently account for .NET reflection Wow, this is so unbelievably amateurish.

[deleted]

Re: CosmosEscape: Taking over Every Database in Azure Cosmos DB

#12

Post by chatmasta »

sakisv wrote: post #7

Is it me or was there a similar vulnerability reported a few years ago? Something about the attacker getting access to all platform's users' databases, though not sure if it was cosmos or something similar.

There have been a lot. I remember one that was essentially “send the request without an Authorization header.”

Re: CosmosEscape: Taking over Every Database in Azure Cosmos DB

#13

Post by delfinom »

lateral_cloud wrote: post #5

It took them 6 months to fix this properly?

They patched the vulnerability within 2 days. They spent 6 months rearchitecting their backend. It's a major service for themselves and tens of thousands of customers, you don't vibe code yourself a new database query execution engine overnight.

Re: CosmosEscape: Taking over Every Database in Azure Cosmos DB

#14

Post by FromOmelas »

sakisv wrote: post #7

Is it me or was there a similar vulnerability reported a few years ago? Something about the attacker getting access to all platform's users' databases, though not sure if it was cosmos or something similar.

Yes. you're thinking of https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...

Re: CosmosEscape: Taking over Every Database in Azure Cosmos DB

#15

Post by phatskat »

lateral_cloud wrote: post #5

It took them 6 months to fix this properly?

Considering that they had to rework things to not use the master key, I can understand the time and effort. From TFA, the DB Gateway handled all Cosmos requests, and used the master key to get an account’s private key and then forward the DB requests. If they had to rearchitect that gateway system, I’m sure it was no small task. Bear in mind, they probably approached this somewhat seriously since Cosmos powers lots of internal M$ tools like Teams and Copilot, not just customer applications.

Re: CosmosEscape: Taking over Every Database in Azure Cosmos DB

#17

Post by sakisv »

ultra2d wrote: post #8
sakisv wrote: post #7

Is it me or was there a similar vulnerability reported a few years ago? Something about the attacker getting access to all platform's users' databases, though not sure if it was cosmos or something similar.

This one from a year ago? https://dirkjanm.io/obtaining-global-admin-in-every-entra-id... "This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments)."

oh ffs, I forgot about this. I was thinking of the other one though from 2021 mentioned in a sibling comment, and it was indeed, again, with cosmos
Post reply on HN