> A privilege escalation vulnerability allowed anyone with a Cosmos DB account to filch the private key for any other Cosmos DB account, by way of the Jupyter notebook functionality.
Could we not be served the same article?
So the good news is you aren't seeing things, that is what the Ars article said. The bad news is that Ars are wrong and these are clearly not private keys but shared secrets.
Other people have linked Microsoft's documentation, the control panel for Cosmos DB lets you ask for new keys and warns you they may take minutes to be ready, so that means it's a shared secret, as a private key would be something you pick and don't reveal to Microsoft.
Indeed. Under FF reader mode the carousel is flattened into normal inline illustrations so I thought for a moment they could A/B test the article content.
I don't believe private keys were in use here, instead I expect these are secrets and the thing about secrets is, as Bono sang, "A secret is something you tell one other person" which means now there's another party that can lose it.
This is a reason to avoid using shared secret schemes and instead prefer private keys, because if access to Cosmos DB required a private key you as the only one with the key know if you gave that to Jupyter, if you didn't then it can't very well have given copies to anybody else. Unfortunately this is also why systems often don't use such an approach, enabling Jupyter across Azure likely earned somebody a promotion.