# ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough

Cosmos DB Jupyter Notebook container allowed root via C# host, firewall flush, WireServer cert theft, and Service Fabric access to steal other tenants' primary keys.

- Payout: unconfirmed
- Severity: critical
- Program: Microsoft
- Credited: Nir Ohfeld, Sagi Tzadik
- Disclosed: 2021-11-10
- Write-up quality: 10/10
- Original: https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough
- Tags: domain:cloud impact:data-leak impact:internal-access kind:research platform:threat-intel sev:critical tech:azure technique:chained technique:reverse-engineering vuln:misconfiguration vuln:secrets-leak

**Target:** Azure Cosmos DB Jupyter Notebook container, WireServer, Service Fabric cluster
**Root cause:** C# notebook host ran as root, local iptables firewall was bypassable, and WireServer returned a Certificates Bond Package containing 25 Microsoft private keys including Service Fabric cluster certs.
**Steps:**
1. Create Cosmos DB with Jupyter Notebook enabled
2. Run C# code in notebook to execute as root; append uid=0 user to /etc/passwd and su
3. Run `iptables -F` to remove local firewall rules blocking 169.254.169.254, 10.0.0.0/16, 168.63.129.16
4. Query IMDS `curl -H Metadata:true http://169.254.169.254/metadata/instance?api-version=2021-02-01` to confirm shared host
5. Query WireServer goalstate `curl http://168.63.129.16:80/machine/?comp=goalstate -H 'x-ms-agent-name: WALinuxAgent' -H 'x-ms-version: 2012-11-30'`
6. Fetch certificates endpoint with attacker-supplied `x-ms-guest-agent-public-x509-cert` header to get CertificatesBondPackage
7. Decompile WindowsAzureGuestAgent.exe with ILSpy to decode Bond format; extract 25 certs+private keys
8. Use `fabric.westus1.cosmos.azure.com` cert to auth to Service Fabric on port 19080 via sfctl
9. Run `sfctl application list` to enumerate 500+ Cosmos DB instances and extract COSMOSDB_ACCOUNT_KEY_ENCRYPTED values
**How found:** Researchers noticed C# notebook code ran as root unlike Python; examined iptables rules and saw deliberately blocked internal IPs, hypothesizing they hid sensitive services; queried them and found IMDS revealed a shared Windows host; WireServer returned an unfamiliar CertificatesBondPackage format, so they decompiled the Windows guest agent to decode it.
**Exploitation:** Attacker with a Cosmos DB account enables Jupyter Notebook, escalates to root via C# host, flushes iptables, queries WireServer for certificates, decodes the Bond package to obtain Microsoft private keys, authenticates to the local Service Fabric cluster, and retrieves encrypted primary keys for other customers' Cosmos DB accounts, enabling full read/write access to their databases.
**Escalation:** Chained LPE + firewall bypass + WireServer cert theft + Service Fabric auth to pivot from single tenant container to cross-tenant database access; also accessed Azure Storage accounts with crash dumps and logs, and could intercept customer notebook TLS via wildcard cert.
**Insight:** When a managed service blocks specific internal IPs via local firewall rules, treat those IPs as a roadmap to sensitive internal services; also check whether different language runtimes in a shared notebook execute with different privileges.