Vulnerabilities Found Inside Azure-Linked Managed Database Service

It’s not unheard of for some threats to remain undiscovered for months or even years, as is the case with a particularly nasty one in the Microsoft Azure database system. This exploit, discovered by cloud security provider Wiz, is built into Cosmos DB, Microsoft Azure’s managed database service. Let’s take a look at the exploit and see what we can learn from it.

The vulnerability is called Chaos DB and is capable of providing read and write access to just about every database on the service. No evidence indicates that the exploit was used by hackers or attackers, but it is still a major problem and one that you should be aware of. The vulnerability comes about as a result of how the database handles primary keys and how Microsoft deployed its default settings for one of their services.

The service in question, Jupyter Notebook, is a feature found in Cosmos DB. Wiz found that this feature was enabled automatically for all instances of Cosmos DB in the month of February 2021, but this issue could go as far back as 2019 when Jupyter first became a feature. A misconfigured setting within Jupyter allows users to obtain the primary keys for other users of Cosmos DB. Since the primary keys give the holder the ability to read, write, and delete data on the database, it is a pretty serious issue.

Primary keys are credentials that do not expire, so if malicious entities get ahold of them, the only solution is to rotate them so that they are no longer useful to whoever steals them. If this is not done, then anyone who has obtained the primary key can potentially gain escalated privileges. Wiz recommends that all users who have Jupyter enabled on their service rotate their keys, no matter how long or short they have used the service for.

Microsoft has since disabled the vulnerability that allowed for Chaos DB, but the company doubled down on the fact that it cannot change the primary keys, instead urging customers to rotate them themselves. Microsoft has also issued a warning to affected customers, which amount to about one-third of the service’s user base, along with instructions on how to limit the risks associated with this vulnerability.

Again, it is extraordinarily important that you prioritize security configurations for your business technology, as you could unknowingly be placing your business’ data or privacy at risk. To remove the guesswork, get Directive on board to give you a hand. We can assist with any configurations your technology needs to remain secure. To learn more, reach out to us at 607.433.2200.