Prototype Pollution vulnerability in SAP HANA Client

Vulnerability

Overview

The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 contain a Prototype Pollution vulnerability. This arises from improper sanitization of user input when the nestTables feature is used [1]. Prototype pollution occurs when an attacker can inject properties into the Object.prototype of JavaScript, affecting all objects of that type in the application runtime.

Exploitation

An attacker can provide specially crafted input designed to pollute the global object prototype. The attack does not require high privileges; it exploits the lack of input validation in the module's handling of nested table results. The vulnerability is reachable through any code path that uses the nestTables option with untrusted data [1].

Impact

Successful exploitation allows the attacker to add arbitrary properties to global object prototypes. According to the vendor, this leads to a low impact on availability. The confidentiality and integrity of the system are not affected [1]. This type of attack can potentially cause application-level denial of service or unexpected behavior due to polluted objects.

Mitigation

The issue is fixed in version 2.21.31 of the @sap/hana-client package. Users should upgrade to this version or later. The fix is included in SAP's regular Security Patch Day cycle [2]. No workarounds have been published; updating the dependency is the recommended course of action.