SAP security note 2376223, "Missing Authorization Check in Dynpro Modeler", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
Dynpro Modeler does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Some well-known impacts of missing authorization checks are:
Abuse of functionality restricted to a particular user group.
Read, modify, or delete restricted data.
Solution
The code with the call transaction is disabled. Please implement the support package mentioned in this SAP Note or follow the respective correction instructions.
Reason and prerequisites
The user already needs S_DEVELOP authorization. A developer can use this privilege to gain access to other transactions by bypassing the checks for S_TCODE.
Full note on SAP: SAP Support Launchpad note 2376223
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].