Executive Summary
Wiz Research identified a critical vulnerability chain named 'CosmosEscape' in the Azure Cosmos DB service. The flaw primarily resided in the custom Gremlin graph query engine, which failed to adequately restrict .NET reflection. This allowed researchers to achieve arbitrary code execution on the DB Gateway, a multi-tenant Service Fabric cluster responsible for processing customer queries.
Technical analysis revealed that by compromising the DB Gateway, an attacker could access a platform-wide signing key known as the 'Cosmos Master Key.' This key enabled the retrieval of primary keys for any Cosmos DB account across the entire service, including internal Microsoft services like Entra ID and Teams. Furthermore, the vulnerability granted access to the 'Config Store,' a regional registry of all Cosmos DB accounts, facilitating precision targeting of specific organizations.
While the impact was potentially catastrophic—enabling total data compromise and cross-tenant escalation—Microsoft has fully remediated the issue. Investigation by Microsoft found no evidence of unauthorized exploitation beyond the controlled research environment, and no customer action is currently required.