Amazon.com Stored XSS via Book MetadataAmazon’s Kindle Library, also known as “Manage Your Content and Devices” and “Manage your Kindle”, is, at the time of writing, vulnerable to Stored Cross-Site Scripting (XSS) attacks. (Update 2014-09-16: After I had published my findings, Amazon fixed the issue.) Malicious code can be injected via e-book metadata; for example, an e-book’s title. Once an attacker manages to have an e-book (file, do
