vulnerability
Critical Flaw Led to Azure Cosmos DB Pwnage
Critical
Summary
A critical vulnerability, dubbed CosmosEscape, in Azure Cosmos DB allowed attackers to obtain a platform-wide key, enabling them to compromise all databases on the service. Wiz researchers exploited this flaw by bypassing a Gremlin sandbox and leveraging .NET reflection to gain code execution, ultimately accessing configuration data and compromising databases across Microsoft’s services, including Entra ID, Teams, and Copilot. Microsoft swiftly deployed a hotfix and implemented a long-term architectural fix.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data