Security News > 2022 > November > Microsoft fixes critical RCE flaw affecting Azure Cosmos DB
Analysts at Orca Security have found a critical vulnerability affecting Azure Cosmos DB that allowed unauthenticated read and write access to containers.
Named CosMiss, the security issue is in Azure Cosmos DB built-in Jupyter Notebooks that integrate into the Azure portal and Azure Cosmos DB accounts for querying, analyzing, and visualizing NoSQL data and results easier.
Azure Cosmos DB is Microsoft's fully managed NoSQL database that features broad API type support for applications of all sizes.
Jupyter Notebooks is a web-based interactive platform that allows users to access Cosmos DB data.
When a user creates a new Notebook on Azure Cosmos DB, a new endpoint is created along with a unique new session/notebook ID. The researchers reviewed the traffic of the request from a newly created notebook to the server and noticed the existence of an Authorization Header.
Since Azure Cosmos DB is a fully managed, serverless distributed database, the fixes are taking place on the server side, so users don't need to take any action to mitigate the risk.
News URL
Related news
- Veeam warns of critical RCE bug in Service Provider Console (source)
- Exploit released for critical WhatsUp Gold RCE flaw, patch now (source)
- Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console (source)
- PoC exploit for critical WhatsUp Gold RCE vulnerability released (CVE-2024-8785) (source)
- Microsoft: Another Chinese cyberspy crew targeting US critical orgs 'as of yesterday' (source)
- Apache issues patches for critical Struts 2 RCE bug (source)
- HubSpot phishing targets 20,000 Microsoft Azure accounts (source)
- Critical RCE Flaw in GFI KerioControl Allows Remote Code Execution via CRLF Injection (source)
- Microsoft Sues Hacking Group Exploiting Azure AI for Harmful Content Creation (source)
- Azure, Microsoft 365 MFA outage locks out users across regions (source)