Press play to start listening
Microsoft has fixed a critical vulnerability in Azure Cosmos DB that could have allowed an attacker to locate and take control of databases belonging to any customer. Wiz Research named the flaw CosmosEscape and said it also placed databases used internally by Microsoft services within reach.
The vulnerability was found in the Gremlin API, an interface used to work with graph databases, where information is stored as connected items and relationships. A malicious user needed an Azure Cosmos DB account of their own, but did not need access to the organization they intended to target.
According to Wiz’s findings shared with Hackread.com, a specially prepared Gremlin query could break out of the restricted environment processing it and run commands on Microsoft’s backend systems. From there, the researchers obtained a platform secret they named the “Cosmos Master Key.”
Master Key Opened Two Paths to Customer Data
Possession of that secret provided two separate capabilities. The first allowed the holder to request the primary key for any Cosmos DB account, giving full permission to read and change data stored in that account.
The second allowed databases hosted by the service to be listed and searched using identifiers such as an Azure tenant ID or subscription ID. An attacker could therefore identify databases belonging to a chosen company and then retrieve the keys needed to access them.
Wiz said the method worked regardless of the database’s region or supported API type and included private databases. Wiz tested the exploit through publicly accessible service endpoints, without compromising the target’s Azure account first.
Microsoft Services Also Use Cosmos DB
Cosmos DB supports applications that need fast access to data in multiple geographic regions. Microsoft also uses it behind services including Entra ID, Teams and Copilot, meaning databases associated with those products could have been identified and accessed through the same weakness, according to Wiz.
This does not mean customer or Microsoft databases were breached. Wiz described the result of controlled security research, while Microsoft told Reuters that the problem had been fully addressed and that its investigation found no evidence of customer impact.
The flaw affected the service itself, so customers could not have fixed it by changing their own application code or Azure settings. The central role of the master key also meant one successful attack could have crossed the normal separation between different customers and Microsoft’s internal services.
“This discovery underscores the value of cloud security research, particularly as the rise of AI is accelerating the pace and sophistication of vulnerability discovery, making attack surface management more critical than ever,” said Robert Costello, Chief Digital and Information Officer at Merlin Group.
“Wiz identified and responsibly disclosed a high-impact vulnerability, allowing time to remediate before it could be broadly exploited. The complexity of this flaw, and its potential to expose every Cosmos DB instance, is a reminder that even the largest cloud providers must constantly test their own environments. This demonstrates why continuous cloud posture visibility and close vendor collaboration are essential to protecting modern cloud environments,“ Robert emphasized.
Microsoft Removes the Cosmos Master Key
After receiving the report, Microsoft removed the platform-wide Cosmos Master Key and introduced additional controls intended to stop similar access from the Gremlin processing environment. Microsoft handled the remediation within its managed Azure infrastructure.
The company’s removal of the shared secret addresses more than the specific query used by Wiz. It also removes the mechanism that allowed one backend credential to retrieve account keys and search database information throughout the service.
CosmosEscape follows Wiz’s 2021 disclosure of ChaosDB, a separate Cosmos DB vulnerability involving the service’s Jupyter Notebook feature. That earlier flaw could also have exposed customer database keys, although the two findings used different entry points.
Nevertheless, organizations using Cosmos DB should still review account activity, key access, and unexpected database operations as part of normal monitoring. Microsoft’s statement that it found no customer impact means there is currently no evidence that attackers used CosmosEscape outside Wiz’s testing.
