SAP security note 2143329, "Missing authorization check in RDDPUTJZ_COPY_TRANSPORT". Below are the symptom and the SAP recommended solution.
Description
Symptom
An authenticated user can use functions of RDDPUTJZ_COPY_TRANSPORT to which access should be restricted. This may result in an escalation of privileges.
Solution
Authorization check ‘TR_AUTHORITY_CHECK_TRFUNCTION’ has been implemented in the RFC-enabled Function-Module EMINT_TRANSFER_PIECELIST.
Please apply the Support Package mentioned in this SAP Note or follow the correction instructions.
Reason and prerequisites
RDDPUTJZ_COPY_TRANSPORT does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 2143329
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].