CosmosEscape Vulnerability in Azure Cosmos DB Allowed Cross-Tenant Takeover
A critical vulnerability dubbed CosmosEscape in Azure Cosmos DB's Gremlin API could have allowed attackers to execute arbitrary code and gain master signing keys, enabling cross-tenant attacks.
Microsoft's Azure Cosmos DB, a globally distributed, multi-model database service, was found to be vulnerable to a critical flaw named CosmosEscape. This vulnerability, discovered by Wiz researchers, resided within the Gremlin API and had the potential to allow attackers to execute arbitrary code on the service's backend infrastructure. The exploit could have led to a devastating cross-tenant attack, impacting millions of customer workloads and even Microsoft's internal systems.
The vulnerability stemmed from insufficient restrictions on .NET reflection within Cosmos DB's custom .NET-based Gremlin engine. While Gremlin servers typically compile queries within a sandboxed environment, the researchers found that Cosmos DB's engine failed to adequately restrict .NET reflection, a feature that allows code to inspect and manipulate other code at runtime. By crafting specific Gremlin queries, attackers could bypass these restrictions, leading to capabilities for file reading, file writing, and ultimately, arbitrary code execution.
A proof-of-concept demonstration showed a specially crafted Gremlin query successfully executing the hostname command directly on the Cosmos DB Gateway, a multi-tenant component responsible for processing customer queries. This initial foothold on the Gateway was crucial, as it provided access to a master signing key. This key was not scoped to a single customer or region, meaning it could be used to retrieve the primary key for any account across tenants, regions, and API formats, including SQL, MongoDB, Cassandra, and Gremlin.
This powerful secret, dubbed the Cosmos Master Key by Wiz, also granted access to the Config Store. This store acts as a master directory for Cosmos DB, containing information on every account, subscription IDs, tenant IDs, network rules, and tags. Attackers could leverage the Config Store to enumerate all accounts within a region or precisely target specific organizations by filtering through tenant IDs.
The combination of the Gremlin sandbox escape and the unscoped Master Key created a potent attack path. Attackers could first discover and enumerate targets using the Config Store, then use the Master Key to obtain their primary keys, thereby gaining full read-write access to their data. The potential impact was immense, as Azure Cosmos DB underpins critical Microsoft services such as Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot, extending the risk to Microsoft's own backend systems.
Even private, network-isolated databases were not safe, as the compromised DB Gateway itself enforced that isolation. The architectural risks highlighted by CosmosEscape underscore the importance of continuous auditing for cloud logging threats and unexpected access patterns across critical data stores in multi-tenant environments.
Wiz responsibly disclosed the CosmosEscape vulnerability to Microsoft, which acted swiftly to deploy a hotfix. Microsoft has since fully remediated the issue by eliminating the Cosmos Master Key and implementing additional architectural safeguards. Importantly, Microsoft's investigation found no evidence that the vulnerability was exploited maliciously before its disclosure, and no immediate action is required from Azure Cosmos DB customers.
This new report from The Hacker News provides further details on the CosmosEscape vulnerability, including the timeline of Microsoft's response and the specific technical mechanisms employed by researchers. It clarifies that the exploit chain initiated with a crafted query against an attacker-controlled Gremlin database, not direct access to a victim's database, and highlights that Microsoft has since implemented a permanent fix across all regions and eliminated the platform-wide key.