Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CosmosEscape: Taking Over Every Database in Azure Cosmos DB

wiz.io | blog | #cloud | #cloud-security | #vulnerability | #azure | #research | #wiz | #cosmos-db | #gremlin

Summary

CosmosEscape: a Gremlin API chain could grant near-full control of Azure Cosmos DB — a 'Cosmos Master Key' to enumerate all databases and fetch any account's primary key; Microsoft remediated it.
Published
Collected

original ↗

Related coverage

  1. Investing Together: Wiz Defend and Google Security Operations (wiz.io)
  2. Wiz achieves GovRAMP High Authorization (wiz.io)
  3. Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise (wiz.io)
  4. Beyond the Perimeter How an On-Premises Domain Admin Compromise Unlocked the Cloud (labs.cognisys.group)
  5. Introducing Continuous Vulnerability Assessment: Real-Time Defense for the AI Threat Era (wiz.io)
  6. 38TB of data accidentally exposed by Microsoft AI researchers (wiz.io)

back