Executive brief
SAP's HANA Node.js client library is used by applications to connect to SAP HANA databases. A prototype pollution vulnerability in versions 2.0.0 through 2.21.30 allows an authenticated attacker to inject arbitrary properties into JavaScript object prototypes, potentially disrupting application availability. This affects organizations running affected client versions connecting to HANA databases.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the SAP HANA Node.js client package affecting versions 2.0.0 through 2.21.30. The root cause is improper input sanitization when the nestTables feature is used, allowing an attacker to add arbitrary properties to global object prototypes. Attack requires authentication (PR:L) and network access to trigger the vulnerability. The impact is limited to availability (Denial of Service), with no effect on confidentiality or integrity. The vulnerability is fixed in version 2.21.31 and later.
Affected products
- SAP HANA Node.js client 2.0.0 through 2.21.30
Timeline
- 2024-10-08: disclosed
- 2024-10-08: patched: Fixed in version 2.21.31