CosmosEscape: Taking Over Every Database in Azure Cosmos DB

What to do

Microsoft has fully remediated CosmosEscape server-side, eliminating the Cosmos Master Key and adding new Cosmos DB guardrails. Per Wiz and Microsoft, no customer action is required — there is no patch to apply, no key to rotate. Microsoft's investigation found no evidence of exploitation beyond Wiz's own research. If you were waiting to decide whether to respond to this disclosure, the answer is that there is nothing to act on; this document exists to let you close that loop rather than to prompt work.

Detail the summary omits

Two points the existing summary does not carry:

• Private and network-isolated accounts were also exposed. Because the DB Gateway is the component that enforces network isolation, code execution on it gave direct access to private databases regardless of IP restrictions. Worse, write access to the Config Store meant an attacker could potentially overwrite network isolation settings themselves — so a firewall/VNet restriction on your Cosmos account would not have protected you.

• The Config Store supported targeted, not just bulk, enumeration. It held account names, subscription IDs, tenant IDs, network settings, and tags, and being a Cosmos DB database it was queryable with the full SQL engine. An attacker could therefore filter by a specific tenant or subscription ID to locate one organization's databases before compromising them — precision targeting at platform scale, all from public endpoints.

The attack chain

flowchart TD
    A[Gremlin query on own DB] --> B[.NET reflection bypasses sandbox]
    B --> C[Code execution on DB Gateway<br/>multi-tenant Service Fabric]
    C --> D[Read cluster creds → Cosmos Master Key]
    D --> E[Query Config Store:<br/>filter by tenant/subscription]
    D --> F[Retrieve any account's primary key]
    E --> G[Target org's databases]
    F --> G
    G --> H[Full read/write, incl. private accounts]

The turning point is the Master Key's scope: Wiz found it was not scoped to one account but worked across tenants, regions, and API flavors (SQL, MongoDB, Cassandra, Gremlin). A single Gremlin query against your own database was the entire entry cost.

Caveats

• The remediation and "no exploitation" findings are Microsoft's own; Wiz reports them without independent long-term telemetry.
• Wiz notes the research was assisted by "Atlas," an early-stage AI vulnerability researcher — relevant context if you are evaluating the source's methodology, not a technical claim about Cosmos DB.