Stored XSS in intensedebate.com via the Comments RSS

Summary

Stored XSS in intensedebate.com via the Comments RSS

In our "comments.rss" file, the blog post's title reflects to the XML (RSS) file without any encoding. So I installed the IntenseDebate on my website (https://wp.s2.cm), and created a blog post with <a:script xmlns:a="http://www.w3.org/1999/xhtml">alert(document.domain)</a:script> payload on the title. Then, I created a comment on that blog post with my IntenseDebate account. And the XSS fired on my comments.rss file: https://www.intensedebate.com/people/kinqlesse/comments.rss

Any user can see that file, so the XSS affects all users. The blog title should reflect to the RSS file with HTML encoding.

For reproducing the attack on your profile :

1. Setup the IntenseDebate on your own website
2. Create a blog post with the <a:script xmlns:a="http://www.w3.org/1999/xhtml">alert(document.domain)</a:script> title
3. Create a comment on that blog post with your IntenseDebate account
4. Go to your account's comments.rss file, and the XSS will fire.