services / Azure / Notebook workspace

A managed Jupyter notebook workspace (hosted compute environment) attached to a Cosmos DB account, used to run notebooks against the account's data.

Supporting compute asset; can run arbitrary code/workloads and incur metered spend.

Microsoft.​DocumentDB/​databaseAccounts/​notebookWorkspaces/​listConnectionInfo/​action

Returns the notebook workspace connection endpoint and authentication token, exporting reusable credential material that lets an attacker connect to and execute code in the notebook compute environment.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links