Affected Software

• Product: eScan Management Console
• Vendor: Microworld Technologies
• Vendor Homepage: https://www.escanav.com
• Software Download: https://cl.escanav.com/ewconsole.dll
• Confirmed Vulnerable Version: 14.0.1400.2281

eScan Management Console is a centralized endpoint security management solution used by enterprises to manage antivirus policies, patch management, device control, and user roles across a corporate network. Its web interface is typically deployed on the internal network and accessible on port 10443.

Technical Analysis

Root Cause

The application fails to sanitize or encode user-supplied input in the Description field of the New Role form before storing it in the database and rendering it back to users. When the role listing page (RoleMainPage) is rendered, the unsanitized payload is written directly into the HTML response, causing the browser to parse and execute the injected script.

Attack Vector

1. An attacker with a valid (possibly low-privileged) account creates a new role.
2. They inject a crafted XSS payload into the Description field — for example:
   root@kitploit:~

   "><script>alert(1)</script>
   

3. The payload is saved to the backend without sanitization.
4. When an administrator or any other user views the Roles page, the stored script is delivered as part of the page and executes automatically in their browser.

Impact

Proof of Concept

Step 1 — Inject the Payload

Log in to the eScan Management Console and navigate to the New Role page. Replace <TARGET_IP> with the actual IP address of the console (e.g., 192.168.1.1):

Fill in New Role Name with any value (e.g., test) and insert the XSS payload into the Description field:

Select any group from the list and click Ok to save the role.

Step 2 — Payload Executes on the Role Listing Page

After the role is saved, the application redirects to the Role Main Page (/ewconsole/ewconsole.dll/RoleMainPage). Because the Description field value is reflected back without sanitization, the injected <script> tag executes immediately, triggering a browser alert dialog.

In a real-world attack, the alert(1) call would be replaced with a payload to exfiltrate the victim's session cookie (e.g., document.cookie) to an attacker-controlled server.

Mitigation & Remediation

Microworld Technologies should apply the following fixes:

1. Output Encoding — HTML-encode all user-controlled data before rendering it in the browser. Use appropriate context-specific encoding (HTML entity encoding for HTML contexts, JavaScript encoding for script contexts).
2. Input Validation — Reject or strip HTML tags and special characters (<, >, ", ', ;) from fields that do not require rich text.
3. Content Security Policy (CSP) — Implement a strict Content-Security-Policy HTTP response header to limit the execution of inline scripts.
4. HttpOnly & Secure Cookie Flags — Set the HttpOnly flag on session cookies to prevent JavaScript from accessing them, reducing the impact of any successful XSS. Additionally, set the Secure flag to ensure session cookies are only transmitted over HTTPS, preventing interception over unencrypted connections.
5. Upgrade — Apply the latest security patches from the vendor. Users should update to a fixed version of eScan Management Console once available.

References

• NVD – CVE-2023-34838
• MITRE CVE Entry
• CWE-79: Improper Neutralization of Input During Web Page Generation
• OWASP: Cross-Site Scripting (XSS)
• Microworld Technologies – eScan

Author

Sahil Ojha — Security Researcher
Discovered and reported: 23 June 2023

Disclaimer

This repository is published for educational and informational purposes only. The information and proof-of-concept code provided here are intended to help security professionals understand the nature of the vulnerability so that it can be patched and defended against. The author does not condone the use of this information for unauthorized or illegal activities. Always obtain proper written authorization before testing any system you do not own.