CosmosEscape: Azure Cosmos DB Sandbox Escape & Cross-Tenant Access
Just finished reading the Wiz report on CosmosEscape, and it’s a stark reminder of the risks inherent in 'black box' PaaS services.
The vulnerability sits in the Azure Cosmos DB Gremlin API. The backend processes Gremlin queries using a JavaScript engine (JJS sandbox). An attacker could craft a specific Gremlin query to break out of this sandbox. Once out, they could execute code on the underlying container. The escalation is wild—grabbing a platform-wide cryptographic key that grants full read/write access to any customer database, not just their own.
It’s patched now, but the implications for cross-tenant isolation are massive.
If you are on the SOC side, you might want to scrub your logs for suspiciously complex Gremlin queries originating from IPs you don't recognize.
AzureDiagnostics
| where Category == "GremlinRequests"
| project TimeGenerated, ClientIP_s, RequestText_s, DurationMs
| where RequestText_s contains "eval" or RequestText_s contains "System"
| order by TimeGenerated desc
While we talk a lot about Shared Responsibility, flaws like this sit entirely on the provider. Yet, we still have to deal with the fallout.
For those using Graph databases in the cloud: How much trust do you put in the vendor's sandbox isolation? Do you implement your own application-layer encryption just in case the 'container' walls fall down?
Great share. We usually treat Graph databases as low-noise, so this is a wake-up call. We don't have specific baselines for Gremlin query complexity, so we’re essentially blind to sandbox escape attempts without specific signatures. I'm setting up the KQL you provided immediately. Anyone else seeing alerts on this?
This is why I always push for Customer Managed Keys (CMK) where possible. Even if the master key was exposed, encrypting data at rest with your own keys adds a layer of safety against this type of mass exfiltration. It might not stop the RCE, but it limits the data loss.
JavaScript sandboxes are notoriously hard to get right. We saw similar issues with other Node.js-based services. The fact that this granted a 'platform-wide key' suggests a key management failure in the orchestration layer, not just a simple escape. Always assume if you get RCE, you get the secrets on that host.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access