A code injection vulnerability in Apache Atlas versions 0.8 through 2.4.0 allows authenticated attackers to compromise data confidentiality and integrity via a vulnerable DSL search endpoint.

This vulnerability involves improper control of code generation (CWE-94) within the DSL search endpoint, where an authenticated attacker can manipulate Gremlin traversal logic using specific configurations to access unintended data.

A successful exploit allows attackers to compromise sensitive enterprise data and potentially manipulate system operations, leading to severe unauthorized data access. With a CVSS score of 8.1 (High), this vulnerability poses substantial risk to organizational data integrity and confidentiality, demanding prompt remediation by security administrators.

Immediate Action: Upgrade Apache Atlas to version 2.5.0 or later, and ensure that the configuration parameter atlas.dsl.executor.traversal is not set to false if running version 2.0 or greater.

Proactive Monitoring: Monitor API query logs and database access patterns for anomalous Gremlin traversal queries or unauthorized search executions.

Compensating Controls: Implement strict role-based access control policies to limit which users can interact with the DSL search endpoint until updates can be applied.

Public Exploit Available: No

Security teams must prioritize updating Apache Atlas to version 2.5.0 to permanently close this code injection vector. Immediate review of user permissions and adherence to secure configuration baselines will significantly reduce organizational risk while patches are deployed.