UI2 missing authorization check when adding a Chip, SAP security note 1876993

SAP security note 1876993, "UI2: missing authorization check when adding a Chip", is a program error note released on 18.07.2013. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of the UI2 Pagebuilding service to which access should be restricted. This may result in an escalation of privileges.

Solution

Apply the note. Ensure that the user has the following authorization for authorization object /UI2/CHIP with CHIP_NAME=<the name of the Chip you want to add, e.g., ‘X-SAP-UI2-CHIP:LAUNCHPAD_CHIP’> and ACTVT=16 (Execute).

Alternatively, the user needs the authorization object S_PB_CHIP with activity 16 (execute) for the CHIP.

Reason and prerequisites

The UI2 Pagebuilding service does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.