Apache Atlas Code Injection Vulnerability Allowing Unintended Data Access

A code injection vulnerability has been identified in Apache Atlas versions 0.8 through 2.4.0. This issue arises from the DSL search endpoint, which accepts user-supplied query strings. Attackers can manipulate Gremlin traversal logic within the allowed grammar characters to access unintended data. For versions 2.0 and above, this vulnerability only occurs when Atlas is deployed with the non-default configuration 'atlas.dsl.executor.traversal=false'.

Impact

Exploitation of this vulnerability allows for unauthorized access to data by manipulating query strings to alter Gremlin traversal logic.

Remediation

Users are advised to upgrade to Apache Atlas version 2.5.0, which addresses this vulnerability.