Wiz researchers disclosed a patched vulnerability in Azure Cosmos DB that exposed platform-wide master keys, potentially granting attackers read and write access to any customer database across Microsoft's cloud platform.
The flaw, dubbed CosmosEscape, exploited the Gremlin query language interface. Attackers could craft malicious queries against a Gremlin database under their control to escape the sandbox environment and achieve arbitrary code execution. From this position, the threat actors could retrieve master keys that authenticate access across the entire Cosmos DB infrastructure, bypassing tenant isolation controls.
Azure Cosmos DB serves as Microsoft's globally distributed NoSQL database service. It handles databases for thousands of enterprises. The vulnerability threatened the confidentiality and integrity of all customer data stored on the platform, regardless of access controls or permissions individual organizations implemented.
The attack chain required no special privileges. An attacker merely needed to operate a Cosmos DB account and send a specially constructed Gremlin query. The sandbox escape granted sufficient system access to extract authentication credentials stored in memory or configuration files.
Wiz did not disclose the exact patch details or indicate how long the vulnerability remained exploitable in production. Microsoft's response timeline remains unclear from available information. The company has not publicly detailed the scope of potential exposure or whether any unauthorized access occurred before patching.
This incident highlights risks inherent to multi-tenant cloud platforms. Sandbox escapes in query engines pose particular danger because database services inherently operate with elevated privileges to manage customer data. A single escape creates pathways to compromise all tenants simultaneously.
Organizations using Azure Cosmos DB should verify they operate the patched version. Cosmos DB customers should review access logs for suspicious query patterns or unexpected data access during the vulnerability window. Microsoft typically documents patches in security advisories that specify affected versions and update procedures.
The disclosure reinforces why cloud providers must implement rigorous isolation between customer workloads