Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Azure Cosmos DB 漏洞暴露平台级密钥，可访问任何数据库

TL;DR

• A critical vulnerability in Azure Cosmos DB, dubbed "CosmosEscape," allowed attackers to escape the Gremlin query sandbox and gain full read/write access across customer tenants.
• The exploit chain leveraged a crafted Gremlin query to execute code on a multi-tenant gateway, exposing a platform-wide signing key (Cosmos Master Key) that could retrieve primary keys for any account across regions and APIs.
• Microsoft patched the vulnerable Gremlin entry point within 48 hours of reporting and completed a long-term fix by eliminating the platform-wide key in July 2026, with no evidence of customer data exposure.
• The flaw highlighted risks in multi-tenant cloud database architectures, particularly around isolation boundaries and secret management in shared infrastructure components.
• Wiz plans to disclose the complete technical chain at Black Hat USA, emphasizing the need for rigorous sandboxing and least-privilege design in managed services.

Why It Matters

This vulnerability underscores the high stakes of secure sandboxing in multi-tenant cloud databases, where a single flaw can cascade into cross-tenant privilege escalation. For AI practitioners and cloud security teams, it reinforces the importance of scrutinizing managed service internals—especially when they handle sensitive data like Teams messages or Copilot logs stored in Cosmos DB. The incident also highlights how seemingly isolated components (e.g., query gateways) can become attack vectors if secrets are improperly scoped or exposed.

Technical Details

• Exploit Chain: Attacker-controlled Gremlin database → crafted query triggers .NET reflection bypass → arbitrary code execution on multi-tenant DB Gateway → extraction of Cosmos Master Key → access to Config Store directory → retrieval of target account primary keys.
• Sandbox Failure: Cosmos DB’s Gremlin engine translated queries into .NET code but failed to restrict reflection APIs, enabling file I/O and command execution outside the intended sandbox.
• Platform-Wide Key Risk: The Cosmos Master Key, used internally by the gateway to sign requests, inadvertently granted ability to fetch primary keys for any Cosmos DB account across SQL, MongoDB, Cassandra, and Gremlin APIs.
• Config Store Exposure: This regional directory contained metadata (account names, tenant IDs, network settings), allowing attackers to map targets and potentially modify network configurations (though not demonstrated against victim accounts).
• Network Isolation Bypass: Compromised gateway enforced network policies from within, meaning even private or VNet-isolated accounts were reachable via the exploit.

Industry Insight

Cloud providers must audit internal secret propagation paths in multi-tenant services, especially when shared components (like query gateways) interact with customer data planes. The elimination of platform-wide keys should become a standard practice in managed database architectures to limit blast radius of sandbox escapes. Additionally, coordinated vulnerability disclosure programs—like Wiz’s partnership with Microsoft—are critical for rapid remediation, though organizations should assume zero-day exposure until patches are universally deployed and validated.

TL;DR

• Wiz发现Azure Cosmos DB存在名为“CosmosEscape”的严重漏洞，允许攻击者通过Gremlin查询沙箱逃逸并获取跨租户数据库的完全读写权限。
• 漏洞利用链涉及.NET反射绕过限制、平台级签名密钥泄露以及Config Store目录访问，最终可提取任意账户的主密钥。
• Microsoft在48小时内阻断入口并在2026年7月完成全区域修复，移除平台级密钥，确认无客户数据被访问。
• 该漏洞影响多租户网关组件，可能波及Teams和Copilot等依赖Cosmos DB的服务，但Wiz未实际访问其数据。
• 此次事件凸显云数据库服务中多租户隔离与密钥管理架构的风险，需强化沙箱边界控制和凭证最小化原则。

为什么值得看

本文揭示了一个高风险的云原生数据库安全漏洞，展示了攻击者如何通过精心构造的查询突破沙箱限制并横向移动至整个云平台。对AI从业者而言，这提醒了在使用托管AI服务（如Copilot）时底层基础设施的安全性至关重要，也强调了供应链攻击和配置错误可能带来的连锁后果。

技术解析

• Wiz的研究人员发现Azure Cosmos DB的自定义Gremlin引擎将查询翻译为.NET代码并在受限环境中执行，但未充分防范.NET反射机制，使攻击者可构建文件读写能力进而实现任意代码执行。
• 成功执行后，攻击者进入DB Gateway组件——运行于多租户Azure Service Fabric集群上的服务，虽不存储用户数据，但能检索目标Cosmos DB账户的主密钥。
• Gateway还持有被称为“Cosmos Master Key”的平台级签名密钥，可用于跨区域、跨租户、跨API（SQL/MongoDB/Cassandra/Gremlin）获取任何账户主密钥。
• 利用该密钥可打开区域性的Config Store数据库，其中包含账户名、订阅ID、租户标识、网络设置等信息，从而定位特定组织并请求其主密钥；同时具备写入权限，理论上可篡改网络策略以绕过私有或隔离账户的保护。
• 尽管Microsoft声称未发现异常活动且无需用户操作，但暴露窗口期未知，且完整 exploit 细节将在Black Hat USA 2026上公开，当前连接指南仍需account host、database、graph path及primary key才能发起查询，具体前置条件尚未披露。

行业启示

• 云服务提供商应重新审视多租户架构中的信任边界设计，尤其是涉及密钥分发与沙箱逃逸防护机制，避免单一组件失效导致全局沦陷。
• 对于依赖第三方数据库服务的AI应用团队，建议定期审查所用平台的最新安全通告，并实施额外的身份验证层或短期令牌替代长期主密钥的使用习惯。
• 安全研究社区与厂商间的协调披露模式值得推广，但同时也推动行业建立更自动化的漏洞检测与响应体系，缩短从发现到修复的时间差，降低潜在影响范围。