Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Potential Microsoft Azure Data Breach Cosmos DB

Potential Microsoft Azure Data Breach Cosmos DB

Written By Anoop C Nair
Last Updated September 9, 2024
Posted In Azure
SHARE

The news coming out now is the potential Microsoft Azure data breach Cosmos DB. The security research organization Wiz found this breach on 9 August and reported it to Microsoft on 12 August. The Wiz team named the vulnerability #ChaosDB.

Azure Cosmos DB is a fully managed NoSQL, relational, and vector database that offers single-digit millisecond response times, automatic scalability, and enterprise-grade security.

It’s interesting to hear that Wiz’s Chief Technology Officer, Ami Luttwak, is a former chief technology officer at Microsoft’s Cloud Security Group.

Microsoft agreed to pay $40,000 to find the flaw and report this #ChaosDB vulnerability. Potential Microsoft Azure Data Breach Cosmos DB

Patch My PC

Potential Microsoft Azure Data Breach Cosmos DB

The #ChaosDB is impacting the Cosmos DB of Azure customers without the need for credentials. It is reported that the Microsoft team disabled the vulnerable notebook feature within 48 hours of Wiz reporting it. As per Wiz, this vulnerability has two parts.

  • Stealing primary keys of Cosmos DB customers
  • Accessing customer data in Cosmos DB
Potential Microsoft Azure Data Breach Cosmos DB - Fig.1
Potential Microsoft Azure Data Breach Cosmos DB – Fig.1

Are You Impacted by the Azure Cosmos DB Data Breach?

As per Wiz’s blog post, every Cosmos DB account that uses the notebook feature created after February 2021 is potentially exposed.

How to Fix Microsoft Azure Data Breach with Cosmos DB

As per the reports, the impacted organizations can follow the steps mentioned in the Microsoft documentation. You will have to secure access to data in Azure Cosmos DB.

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here –HTMD WhatsApp.

Author

Anoop C Nair has been Microsoft MVP for 10 consecutive years from 2015 onwards. He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career, etc.

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Azure

Azure Files Goes Cloud-Native with Entra-Only Identities and Managed Identities

Key Takeaways Managed Identity and Entra-Only identities for Azure Files help organizations build a fully cloud-native and secure storage environment by removing the need for passwords, storage account keys, on-premises Active Directory, or hybrid identity infrastructure. With native Microsoft Entra ID authentication, applications, virtual machines, and users can securely access Azure Files using identity-based authentication […]

AC Anoop C Nair 4 min read
Azure

Microsoft Dev Box Moves to Maintenance Mode as Windows 365 Takes Lead for Developer Scenarios

key Takeaways: Let’s discuss about Microsoft Dev Box Moves to Maintenance Mode as Windows 365 Takes Lead for Developer Scenarios. Microsoft announced the Maintenance mode in Dev Box, and no additional features are planned. Microsoft’s investments for developer cloud environments are focused on Windows 365, which provides a unified, scalable solution for developer scenarios. Microsoft […]

AC Anoop C Nair 3 min read
Azure

Multi-Zone Management Platform Architecture for Windows Cloud Solutions

Key Takeaways Multi-Zone Management Platform Architecture for Windows Cloud Solutions! This architecture highlights the core MicrosoftMicrosoft Azure components used to host and deliver Cloud PC services. To ensure high availability and reliability, the infrastructure is distributed across multiple availability zones within each region. This design helps protect the service from zonal outages and keeps workloads […]

AC Anoop C Nair 4 min read
Azure

How to Protect and Recover your Infrastructure with Azure Site Recovery

Key Takeaways Azure Site Recovery is a disaster-recovery service in Microsoft Azure that helps keep your applications running if a cloud region fails. Normally, your virtual machines (VMs) run in one region. ASR creates a copy of those machines in another region so that if the main region goes down, your services can continue running […]

AC Anoop C Nair 4 min read