Vulnerability Details

What Is Reflected XSS?

Cross-Site Scripting (XSS) is a class of injection attack where malicious scripts are injected into otherwise trusted web pages. In a reflected variant, the payload is embedded in a crafted URL and immediately "reflected" back to the user in the server's HTTP response. The victim's browser executes the script in the context of the vulnerable site, granting the script the same trust level as legitimate page content.

Common consequences include:

• Session hijacking — stealing cookies to impersonate authenticated users.
• Credential theft — overlaying fake login prompts.
• Malware distribution — redirecting users to attacker-controlled pages.
• Defacement / UI manipulation — altering the visual content of the page.

Technical Analysis

The AssignPolicyTemplate endpoint in eScan's management console accepts several GET parameters and renders them inside an HTML page without sanitising special characters such as ", <, and >. This means a value like:

breaks out of the surrounding HTML attribute context and injects a fully executable <script> tag into the DOM.

Vulnerable Parameters

Proof of Concept (PoC)

⚠️ For educational and authorised testing purposes only.

Steps to Reproduce

1. Authenticate — Log in to the eScan Management Console with valid credentials.

2. Craft the malicious URL — The following URL exploits the type parameter to inject a <script> tag that exfiltrates the victim's session cookie:

   root@kitploit:~

   https://<target-host>/ewconsole/ewconsole.dll/AssignPolicyTemplate?type=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&edit=0&txtPolicyType=&txtPolicyPath=!!!!%24%5CPolicies&Deletefileval=Roaming%20Users_Policy2&defaultpolicy=1
   

   URL-decoded payload in type:

   root@kitploit:~

   "><script>alert(document.cookie)</script>
   

3. Deliver the URL — Send the crafted link to an authenticated administrator (e.g., via email or chat).

4. Observe execution — Upon visiting the URL, the browser executes the injected script. An alert dialog displays the current session cookie, confirming arbitrary JavaScript execution.

Screenshots

Step 1 — Navigating to the vulnerable URL:

Step 2 — XSS alert popup with session cookie:

Step 3 — Admin cookie exposed, ready for session hijacking:

Impact

An attacker who successfully exploits this vulnerability can:

• Steal administrator session cookies and use them to take over the management console without knowing credentials.
• Pivot to managed endpoints — since the console manages antivirus policies across an organisation, console takeover may allow an attacker to disable security policies across all managed devices.
• Conduct phishing attacks by injecting fake UI elements (login prompts, error messages) into the trusted console domain.
• Execute arbitrary actions within the console on behalf of the victim (create accounts, modify policies, download reports).

Remediation

Microworld Technologies should apply the following mitigations:

1. Output encoding — Use context-aware output encoding for all user-supplied values before rendering them in the page. In an HTML attribute context (which is where these parameters are injected), at a minimum encode <, >, ", ', and & as their HTML entity equivalents. Note that encoding strategy differs by context: HTML body, HTML attributes, JavaScript, and URL contexts each require their own encoding rules.
2. Input validation — Reject or strip characters that have no legitimate use in the affected parameters.
3. Content Security Policy (CSP) — Deploy a strict CSP header (script-src 'self') to prevent inline script execution even if an XSS payload is injected.
4. Security testing — Integrate automated XSS scanning (e.g., OWASP ZAP, Burp Suite) into the CI/CD pipeline to catch regressions early.

References

• NVD — CVE-2023-33732
• OWASP — Cross-Site Scripting (XSS)
• OWASP — XSS Prevention Cheat Sheet
• CWE-79: Improper Neutralization of Input During Web Page Generation

Disclaimer

This repository is published for educational and responsible disclosure purposes only. The proof-of-concept information provided here must not be used to attack systems without explicit written permission from the system owner. The author assumes no liability for any misuse of the information contained herein.