This vulnerability was discovered and responsibly disclosed by Sahil Ojha on 23 June 2023, and has been assigned the identifier CVE-2023-34835.

Vulnerability Details

Affected Product

eScan Management Console is an enterprise security management platform developed by Microworld Technologies. It is used by organizations to centrally manage endpoint security policies, antivirus deployments, reports, and alerts across their internal network. Because the console typically resides on an internal (corporate) network and requires authentication to access, this vulnerability is exploitable by authenticated insiders or attackers who have gained a foothold on the network.

Vulnerable component: The Report Template deletion endpoint does not sanitize or encode the delete_file parameter before reflecting it back in the HTTP response, allowing JavaScript payloads to be executed in the context of the victim's browser session.

Technical Analysis

The eScan Management Console's Report Template feature exposes a POST endpoint for deleting report template files. The server-side handler reflects the value of the delete_file parameter directly into the HTML response without proper output encoding or input validation. When a crafted request containing a JavaScript payload is sent, the browser interprets and executes the injected script.

Attack vector summary:

1. An attacker (or malicious insider) intercepts or crafts a POST request to the delete-report-template endpoint.
2. The delete_file parameter is replaced with an XSS payload such as ">.
3. The server reflects the unsanitized value in the response page.
4. The victim's browser renders the response and executes the injected script.

Because session cookies are accessible via document.cookie (and are not protected by the HttpOnly flag in the affected version), this XSS can be chained with a session-hijacking attack to perform full account takeover.

Proof of Concept (Steps to Reproduce)

Prerequisites: Valid credentials for an eScan Management Console instance (internal network access required).
Tools needed: A web browser and an HTTP interception proxy (e.g., Burp Suite).

Step 1 — Log in to the eScan Management Console

Authenticate to the eScan Management Console using valid user credentials. The console is typically accessible only from within the organization's internal network.

Step 2 — Navigate to Report Templates and initiate a deletion

1. In the left-hand navigation menu, locate the Report Template section.
2. Select any existing report template from the list.
3. Click the Delete button to trigger a delete action.

Step 3 — Intercept the DELETE request in Burp Suite

Using Burp Suite (or another HTTP proxy), intercept the outgoing POST request that is generated when the delete button is clicked. The request will contain a delete_file parameter whose value is the name of the report template file.

Replace the value of delete_file with an XSS payload, for example:

Step 4 — Forward the request and observe code execution

Forward the modified request. The server reflects the injected payload in the response without sanitization. The browser executes the JavaScript, and an alert dialog displays the victim's session cookie.

The session cookie exposed here can be exfiltrated to an attacker-controlled server and used to hijack the authenticated session (account takeover).

Impact

While exploitation requires an authenticated session on an internal network, the impact is significant given that eScan Management Console administrators typically have broad access to endpoint security configurations.

Mitigation & Remediation

The following actions are recommended to address this vulnerability:

1. Apply vendor patches: Contact Microworld Technologies support (https://www.escanav.com) or check the official download portal for updated versions of eScan Management Console that address this vulnerability.
2. Input validation: Ensure that all user-supplied input (including POST parameters like delete_file) is validated against a strict allowlist before processing.
3. Output encoding: All data reflected into HTML responses must be properly HTML-encoded (e.g., < → <, > → >) to prevent script injection.
4. Set HttpOnly cookie flag: Mark session cookies with the HttpOnly attribute to prevent client-side scripts from accessing them, reducing the impact of any XSS vulnerability.
5. Content Security Policy (CSP): Implement a strict CSP header to limit the sources from which scripts can be loaded and executed.
6. Network access controls: Restrict access to the eScan Management Console to trusted IP ranges and require VPN for remote access.

References

• NVD – CVE-2023-34835
• MITRE CVE Entry – CVE-2023-34835
• CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
• OWASP – Cross Site Scripting (XSS)
• Microworld Technologies – eScan Antivirus

Disclaimer

This repository and the information contained within are provided strictly for educational and authorized security research purposes. The proof-of-concept details are intended to help defenders understand the vulnerability so it can be properly remediated.

Do not use this information to attack or compromise systems you do not own or have explicit written permission to test. Unauthorized use of this information may violate applicable laws and regulations. The author assumes no liability for any misuse of this material.