CVE-2024-45277

Name of the Vulnerable Software and Affected Versions SAP HANA Node.js client package versions 2.0.0 through 2.21.30

Description The issue is related to a Prototype Pollution vulnerability in the SAP HANA Node.js client package, specifically affecting the nestTables feature. This vulnerability allows an attacker to add arbitrary properties to global object prototypes due to improper user input sanitation. The exploitation of this issue may cause low impact on the availability of the application, with no impact on Confidentiality and Integrity.

Recommendations For SAP HANA Node.js client package versions 2.0.0 through 2.21.30, update to version 2.21.31 or later to resolve the issue. As a temporary workaround, consider disabling the nestTables feature until a patch is available. Restrict access to the vulnerable nestTables function to minimize the risk of exploitation. Avoid using the nestTables feature in the affected API endpoints until the issue is resolved.