Flash Report: Cosmos DB Vulnerability

Flash Report: Cosmos DB Vulnerability

On August 12, 2021, cloud security firm Wiz privately disclosed a vulnerability to Microsoft in the Azure cloud platform that allowed for a remote takeover of Cosmos databases. The vulnerability, dubbed “ChaosDB,” allowed for full administrative access to other customers’ database instances without previously having access to the target environment. By exploiting the Jupyter Notebook feature of Cosmos DB, an attacker could obtain a set of credentials related to the targeted database. Although ZeroFox has not observed the exploitation of ChaosDB in our continuous monitoring, ZeroFox does assess that ChaosDB is a critical vulnerability based on the level of access achieved through exploitation, previous dark web targeting of Microsoft Azure products, and the release of a proof of concept video.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

On August 9, 2021, cloud security firm Wiz discovered a vulnerability in the Azure cloud platform that allowed for a full account takeover of Cosmos DB instances. On August 12, 2021, Wiz privately disclosed the issue to Microsoft. The vulnerability was part of Jupyter Notebook, enabled by default in Cosmos DB. When exploited, an attacker could obtain credentials for the target Cosmos DB. These credentials granted full administrative access to the database, allowing full read, write, and delete privileges to targeted Cosmos DB instances. At Microsoft’s request, Wiz has not yet published the details of their exploit. Figure 1 is a chart mapping out the attack cycle.

Figure 1: A diagram by Wiz showing the attack cycle
Source: Wiz Research Team

Chatter on Cybercriminal Forums

ZeroFox has previously observed generalized chatter on underground cybercriminal forums and channels targeting Microsoft Azure products, but nothing specific to the ChaosDB vulnerability. For example, in May 2020 a threat actor on a private Russian-language forum attempted to recruit hackers skilled in operating with Azure and other technologies (Figure 2).

Figure 2: A recruitment for hackers by actor “Jendely”
Source: ZeroFox Threat Intelligence

A translation of the screenshot in Figure 2 reads:

Due to the increase in the flow of existing tasks, we expand the team. Two slots. The requirements are below.

• Metasploit / Cobalt Strike / Powershell Empire
• Active Directory
• Windows / Linux privesc
• MsSql, Mysql / Oracle
• Azure / AWS
• CMD / PowerShell / bash kung fu :)

Knowledge of PL is a big plus

• Python / GoLang / C ++ / ASM
• PHP / JS / .net

In another instance of chatter on a cybercrime forum, a Russian-speaking actor advertised the sale of access for an international startup company in late May 2021. The actor states that the targeted organization is mainly hosted on Azure, and that they have full root access to all internal infrastructure, including Azure credentials. However, it is unclear if the ChaosDB vulnerability was used to obtain this access.

Figure 3: Actor "cronoxos" claims to have full root access to an Indian-US startup company
Source: ZeroFox Threat Intelligence

From November 27, 2020 to November 30, 2020, Telegram channel @exconfidential published multiple posts containing stolen source code from various organizations, including Microsoft. Members of the channel would then post the entire projects online to be downloaded. It is not currently known whether this incident is connected to the ChaosDB vulnerability.

Figure 4: A Telegram message showing Jenkins usage at Microsoft
Source: ZeroFox Threat Intelligence

Conclusion

Within 48 hours of being notified by Wiz, Microsoft disabled the vulnerable Jupyter Notebook feature. On August 26, 2021 Microsoft began notifying more than 30% of its Cosmos DB customers of the issue and released the following statement:

Microsoft has recently become aware of a vulnerability in Azure Cosmos DB that could potentially allow a user to gain access to another customer's resources by using the account's primary read-write key. This vulnerability was reported to us in confidence by an external security researcher. Once we became aware of this issue on 12 August 2021, we mitigated the vulnerability immediately.

We have no indication that external entities outside the researcher had access to the primary read-write key associated with your Azure Cosmos DB account(s). In addition, we are not aware of any data access because of this vulnerability. Azure Cosmos DB accounts with a vNET or firewall enabled are protected by additional security mechanisms that prevent risk of unauthorized access. Out of an abundance of caution, we are notifying you to take the following actions as a precautionary measure.

According to Wiz, the number of affected customers may be higher than the 30% that received notifications. Although the Wiz Research Team has not yet released any technical information, the team did publish a proof of concept video on YouTube. More information and future updates can be found on the Chaos DB website.