Compliance Impact

The vulnerability allows an attacker to alter query logic to access unintended data, which could lead to unauthorized data exposure.

Such unauthorized access to sensitive data may impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on data confidentiality and access.

However, the provided information does not explicitly describe the compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is an Improper Control of Generation of Code, also known as a Code Injection vulnerability, found in Apache Atlas. The issue arises because Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. An attacker can manipulate the Gremlin traversal logic within the allowed grammar characters to access data that they are not intended to access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to access unintended data by altering the query logic in Apache Atlas. This could lead to unauthorized data exposure, potentially compromising sensitive information. The impact is significant as indicated by the CVSS score of 7.1, with high confidentiality impact and low integrity impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users are recommended to upgrade Apache Atlas to version 2.5.0, which fixes the issue.

Additionally, for affected versions 2.0 and above, ensure that the non-default configuration atlas.dsl.executor.traversal is not set to false, as the vulnerability only exists when this setting is false.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the version of Apache Atlas running on your system and verifying the configuration setting related to the DSL executor traversal.

• Check the Apache Atlas version to see if it is between 0.8 and 2.4.0.
• For versions 2.0 and above, verify if the configuration 'atlas.dsl.executor.traversal' is set to false, which enables the vulnerability.
• Monitor or log requests to the DSL search endpoint for unusual or suspicious user-supplied query strings that could alter Gremlin traversal logic.

Example commands to detect the vulnerability might include:

• To check the Apache Atlas version: `atlas_version=$(atlas --version)` or check the version in the application logs or package manager.
• To check the configuration setting, search the Atlas configuration file (e.g., `atlas-application.properties`) for the line: `grep atlas.dsl.executor.traversal /path/to/atlas-application.properties`
• To monitor DSL search endpoint usage, use network monitoring tools or web server logs to look for suspicious query strings targeting the DSL search endpoint.

Useful 0 Not Useful 0