COSMOSESCAPE: TAKING OVER EVERY DATABASE IN AZURE COSMOS DB

Summary from the TLDR InfoSec newsletter

Wiz Research bypassed Cosmos DB's Gremlin sandbox by abusing .NET reflection to achieve arbitrary code execution on the DB Gateway, then extracted a platform-wide "Cosmos Master Key" capable of retrieving any account's primary key and enumerating every database on the service by tenant or subscription ID, including Microsoft's own internal Cosmos DB-backed services like Entra ID, Teams, and Copilot. The flaw affected private and network-isolated accounts as well, since the DB Gateway itself enforced isolation and was the component compromised. Microsoft deployed a hotfix within 48 hours of disclosure, eliminated the master key entirely, and completed a hardened architecture rollout by July. There was no evidence of exploitation beyond Wiz's own testing.