- Microsoft introduced Jupyter notebook support for Cosmos (who even asked for this?) and it was turned on for all customers automatically February 2021
- Security researchers find a way to break out of the container running the notebook and get long lived credentials to other people’s databases
- The credentials can be used off network. I assume with the public Azure API.
Don’t let your intern projects go into production without thorough security review.
Agree and that is why building a secure Cloud Landing Zone for enterprises goes hand in hand enabling developers to have the autonomy with Guardrails
This is my early and potentially slightly erroneous understanding of the situation:
- Jupiter Notebook support was enabled if you used the SQL API and not the Gremlin or MongoDB API. What is unclear is whether breaking out of the Notbook container gave you access to keys for just instances using SQL API or any API.
- CosmoDB is very weak in enforcing identity perimeters so keys are a weak point. Enforcing something like hourly key rotations is left up to the customer to build.
- Azure is pretty much an "it's public IP" unless you explicitly make it private. And even when they add controls like Private end points they have weird routing mechanisms that can result in traffic bypassing controls like hub firewalls.
- Using things like CosmoDB firewalls, private endpoints, automatic regular key rotations, and only enabling features you need should have helped if this was a hostile breach.
"notebook support for Cosmos (who even asked for this?) "
Lots of users. The functionality itself is great. CosmosDB is a nice OLTP datastore with a flexible schema, and the ability to run OLAP queries over that data with SQL makes it a powerful tool.
- Microsoft introduced Jupyter notebook support for Cosmos (who even asked for this?) and it was turned on for all customers automatically February 2021
- Security researchers find a way to break out of the container running the notebook and get long lived credentials to other people’s databases
- The credentials can be used off network. I assume with the public Azure API.
Don’t let your intern projects go into production without thorough security review.