Security Market Segment LS
Friday, 27 August 2021 11:20

Microsoft silent about major flaw in Azure's Cosmos database Featured

Microsoft silent about major flaw in Azure's Cosmos database Image by Gerd Altmann from Pixabay

A glaring security hole in Microsoft Azure's flagship Cosmos database has been revealed by the security firm Wiz which described it as an "an unprecedented breach" and dubbed it ChaosDB.

Microsoft has made no public statement about the issue though Wiz notified the software behemoth about the flaw on 12 August after having discovered it three days earlier.

Wiz issued a blog post about the vulnerability which it made public soon after Reuters had reported about it, with the news agency finding out about the snafu through emails sent to customers.

The vulnerability allows outsiders to access keys that control entry to databases that are held by thousands of customers. The keys can only be changed by the customers.

Reuters said Microsoft had contacted customers and told them to create new keys.

In the post, Wiz's Nir Ohfeld and Sago Tzadik said big companies like Coca-Cola, Exxon-Mobile and Citrix used Cosmos DB to manage gigabytes of data in real-time.

"As one of the simplest and most flexible ways for developers to store data, it powers critical business functions like processing millions of prescription transactions or managing customer order flows on e-commerce sites," the duo wrote, adding that exploiting the flaw was trivial.

They said while database exposures had quite common with the migration to the cloud, these leaks were usually caused by misconfigurations in the customer’s environment.

"In this case, customers were not at fault," Ohfeld and Tzadik wrote. "Rather, a series of flaws in a Cosmos DB feature created a loophole allowing any user to download, delete or manipulate a massive collection of commercial databases, as well as read/write access to the underlying architecture of Cosmos DB."

They said while Microsoft had acted swiftly after being notified, "customers may still be impacted since their primary access keys were potentially exposed".

"These are long-lived secrets and in the event of a breach, an attacker could use the key to exfiltrate databases," the pair noted. "Today [Thursday] Microsoft notified over 30% of Cosmos DB customers that they need to manually rotate their access keys to mitigate this exposure.

"Microsoft only emailed customers that were affected during our short (approximately week-long) research period. However, we believe many more Cosmos DB customers may be at risk. The vulnerability has been exploitable for at least several months, possibly years."

Read 2459 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here


The past year has seen a meteoric rise in ransomware incidents worldwide.

Over the past 12 months, SonicWall Capture Labs threat researchers have diligently tracked the meteoric rise in cyberattacks, as well as trends and activity across all threat vectors, including:

Encrypted threats
IoT malware
Zero-day attacks and more

These exclusive findings are now available via the 2022 SonicWall Cyber Threat Report, which ensures SMBs, government agencies, enterprises and other organizations have the actionable threat intelligence needed to combat the rising tide of cybercrime.

Click the button below to get the report.



It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site and prominent Newsletter promotion and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.


Sam Varghese

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

Share News tips for the iTWire Journalists? Your tip will be anonymous




Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News