Cybersecurity researchers from cloud infrastructure security company Wiz discovered a series of flaws in one of the features of the database service, which could be exploited by threat actors to gain complete control over a database, meaning they could read or even delete data.
We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.
- We’ve rounded up the best cloud databases on the market
- These are the best endpoint protection tools
- Also check our list of the best cloud hosting on the market
“Every CISO’s nightmare is someone getting their access keys and exfiltrating gigabytes of data in one fell swoop. So you can imagine our surprise when we were able to gain complete unrestricted access to the accounts and databases of several thousand Microsoft Azure customers, including many Fortune 500 companies,” write Wiz’s Nir Ohfeld and Sagi Tzadik in a joint blog post.
The security researchers note that exploiting the vulnerability, which they’ve named ChaosDB, was “trivial.”
The vulnerability exists in the Jupyter Notebook feature that helps users visualize their data. It was introduced in 2019 and was automatically enabled for all Cosmos DB databases in February 2021.
Without giving out too many details, the researchers note that Jupyter’s implementation gave attackers access to the database’ primary keys and other highly sensitive secrets such as its blob storage access token.
Exploiting these details keys, the researchers were able to access and exercise full read/write/delete control over the database from across the internet.
On being notified by the researchers, Microsoft quickly disabled the vulnerable notebook feature to prevent leaking secrets. The company is also asking a section of its users to rotate their keys to ensure that any keys that have already been exfiltrated by unauthorized users are rendered useless.
According to Reuters, Microsoft's email highlighted the fact that the company had found no evidence to suggest that the flaw had been exploited.
- Check our list of the best cloud computing services right now
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Did Qualcomm just launch the first true 'App Store' for AI? AI Hub comes with 75 models for free, but you will have to be a developer to take full advantage of it
'Up to 1,000x faster': AI startup wants to make GPU training obsolete with an extraordinary piece of tech — meet the Tseltin machine which may come to a device near you sooner than you think