Wiz details ChaosDB vulnerability in Black Hat Europe talk

Wiz Research has disclosed the full technical details of ChaosDB, a vulnerability in Microsoft’s Azure Cosmos DB that could have allowed attackers to take over the service. The team presented the findings at Black Hat Europe 2021, revealing that the attack chain exploited misconfigurations in the Jupyter Notebook feature to obtain internal secrets and credentials.

With these, they gained admin access to over 100 Cosmos DB management panels, which could have enabled a service takeover affecting Microsoft’s security posture. Microsoft mitigated the issue within 48 hours of the report.