CVE-2024-45277
📋 TL;DR
The SAP HANA Node.js client package versions 2.0.0 through 2.21.30 are vulnerable to prototype pollution when using the nestTables feature. This allows attackers to add arbitrary properties to global object prototypes, potentially causing application instability. Organizations using affected versions of the SAP HANA Node.js client are impacted.
💻 Affected Systems
- SAP HANA Node.js client package (@sap/hana-client)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Application crashes or denial of service due to prototype pollution corrupting global objects, leading to system instability.
Likely Case
Low availability impact with potential application errors or crashes when malicious input is processed through nestTables.
If Mitigated
Minimal impact if proper input validation and sanitization are implemented, or if nestTables feature is disabled.
🎯 Exploit Status
Exploitation requires access to API endpoints using nestTables feature with user-controlled input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.21.31 and later
Vendor Advisory: https://me.sap.com/notes/3520100
Restart Required: Yes
Instructions:
1. Update @sap/hana-client package to version 2.21.31 or later using npm update @sap/hana-client. 2. Restart all Node.js applications using the updated package. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable nestTables feature
allAvoid using the nestTables option in HANA client queries if not required.
Modify application code to remove or avoid nestTables: true parameter in database queries
Input validation
allImplement strict input validation and sanitization for all user inputs passed to database queries.
Implement input validation middleware before processing database queries
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs
- Disable or avoid using the nestTables feature in application code
🔍 How to Verify
Check if Vulnerable:
Check package.json for @sap/hana-client version between 2.0.0 and 2.21.30Check Version:
npm list @sap/hana-clientVerify Fix Applied:
Verify @sap/hana-client version is 2.21.31 or higher in package.json and node_modules📡 Detection & Monitoring
Log Indicators:
- Application errors related to prototype pollution
- Unexpected application crashes when processing database queries
- Error logs mentioning nestTables or HANA client
Network Indicators:
- Unusual database query patterns with nestTables parameter
- Increased error responses from API endpoints using HANA client
SIEM Query:
source="application.log" AND ("prototype pollution" OR "nestTables" OR "@sap/hana-client") AND severity=ERROR