Summary
A vulnerability chain in Azure Cosmos DB's Gremlin API allowed attackers to escape sandboxes, steal a platform-wide master key, and gain full read/write access to any customer or internal Microsoft database.
Take Action:
If you use Azure Cosmos DB (especially with the Gremlin API), rotate your primary account keys now, since Microsoft's fix removed the flaw but any keys exposed earlier stay valid until you replace them. Then move away from static keys altogether by switching your apps to managed identities and role-based access control, and review your Cosmos DB access logs for anything unexpected.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)