CosmosEscape Vulnerability Enables Full Takeover of Azure Cosmos DB Databases

A critical vulnerability chain in Azure Cosmos DB, named CosmosEscape, allowed attackers to gain full read and write access to every Cosmos DB database, including potentially those managed internally by Microsoft.

The issue specifically affected the service’s Gremlin API. It exposed a cross-tenant attack path that could bypass customer network isolation controls.

CosmosEscape Vulnerability

According to Wiz Research, the CosmosEscape vulnerability originated from a weakness in the custom Gremlin query engine used by Azure Cosmos DB.

During testing of Gremlin queries, researchers encountered .NET exceptions, which indicated that the service was translating graph queries into executable .NET code.

Further analysis revealed that the engine’s security restrictions were insufficient to prevent the use of .NET reflection techniques. This oversight enabled researchers to develop methods for accessing files and ultimately execute arbitrary code on the Cosmos DB backend.

The code execution occurred within the DB Gateway. This multi-tenant service processes customer queries on Cosmos DB’s Service Fabric infrastructure.

While customer databases were not directly hosted on the compromised gateway clusters, the DB Gateway required privileged access to retrieve account information and connect to databases on behalf of users.

Researchers discovered credentials within the environment that provided access to a platform-wide signing key, which Wiz referred to as the “Cosmos Master Key.”

Unlike keys limited to individual customer accounts, this master key could access the primary key for any Azure Cosmos DB account across different tenants, geographic regions, and supported API types, including SQL, MongoDB, Cassandra, and Gremlin.

Possession of an account’s primary key grants full administrative data-plane access, allowing an attacker to read, modify, or delete data stored in that account’s Cosmos DB databases.

This attack chain enabled a malicious actor to move from executing commands in the Gremlin query environment to recovering keys for arbitrary Cosmos DB tenants.

The Cosmos Master Key also granted access to the Cosmos DB Config Store. This regional account directory contains metadata, including database account names, subscription identifiers, tenant identifiers, network settings, and tags.

Since the Config Store itself was hosted in Cosmos DB, attackers could potentially query it to enumerate accounts within a region or filter records to identify databases belonging to specific organizations.

This capability escalated the vulnerability beyond simple data exposure. An attacker could have identified a target tenant, retrieved its Cosmos DB primary key, and accessed all databases associated with that account.

Wiz noted that even private and network-isolated Cosmos DB deployments might have been affected because the DB Gateway enforces network access restrictions. Additionally, write access to configuration data could have allowed changes to network isolation settings.

Azure Cosmos DB underpins several Microsoft services, including Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot. As such, the vulnerability highlighted the risks associated with compromising a foundational multi-tenant cloud service for both customers and higher-level cloud products.

Microsoft has fully remedied the CosmosEscape vulnerability, eliminated the platform-wide key, and implemented additional architectural protections. The company investigated the issue and found no evidence of exploitation beyond Wiz’s authorized research. Microsoft also stated that no action is required from customers.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.