August 29, 2021

Microsoft has fixed a critical vulnerability affecting Azure Cosmos DB.

Azure Cosmos DB is a globally distributed and fully managed NoSQL database service.

The vulnerability

The vulnerability gives any Azure user full admin access (read, write, delete) to another customer’s Cosmos DB instances without authorization.

The vulnerability has a trivial exploit that doesn’t require any previous access to the target environment.

Microsoft stated that there have been no indications of exploitation of this vulnerability

Mitigation

Microsoft has advised Azure customers to regenerate the Cosmos DB Primary Keys.

Microsoft also advised customers to take the following recommended actions to further secure their Azure Cosmos DB databases:

1. Schedule a regular rotation and regeneration of your primary and secondary keys.
2. As a standard security best practice, consider using the Azure Cosmos DB firewall and virtual network integration to control access to your accounts at the network level.
3. If you are using the Azure Cosmos DB Core (SQL) API, consider using the Azure Cosmos DB role-based access control (RBAC) to authenticate your database operations with Azure Active Directory instead of primary/secondary keys.
   With RBAC, you have the option to completely disable your account’s primary/secondary keys.
4. For a complete overview of the security controls available on Azure Cosmos DB, refer to our security baseline.

References: Wiz.io advisory