PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CosmosEscape: Taking Over Every Database in Azure Cosmos DB

wiz.io | blog | #cloud | #cloud-security | #vulnerability | #azure | #research | #wiz | #cosmos-db | #gremlin
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CosmosEscape: a Gremlin API chain could grant near-full control of Azure Cosmos DB — a 'Cosmos Master Key' to enumerate all databases and fetch any account's primary key; Microsoft remediated it.
Published
Collected

Related coverage

blog · specterops.io
Head in the Clouds: Microsoft Azure
# Head in the Clouds: Microsoft Azure Author Christopher Maddalena Read Time 8 mins Published Sep 16, 2018 ##### Share * Introduction * Head in the Clouds – Christopher Maddalena – Medium * In the...
blog · wiz.io
ASPM in the AI Era Part 2: Prioritize Exploitable Risks with Code-to-Cloud Context
Transform raw scanner output into actionable risk. Discover how Wiz ASPM enriches third-party findings, deduplicates alerts, and maps true attack paths.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage
blog · wiz.io
Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack
Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them.
blog · vercel.com
Mitigating Denial of Wallet risks with Vercel
Protect against Denial of Wallet (DoW) attacks with Vercel. DoW exploits cloud scalability to inflate costs. Vercel provides solutions like budget alerts, spend limits, and anomaly detection to safeguard workloads and maintain financial stability.
Back