312-50V10 · Question #365
Which of the following is a common Service Oriented Architecture (SOA) vulnerability?
The correct answer is D. XML denial of service issues. SOA environments rely heavily on XML-based messaging (SOAP, WSDL), making XML-specific attacks such as XML denial of service a common and significant vulnerability. Attackers can exploit malformed or recursively nested XML payloads to exhaust parser resources.
Question
Which of the following is a common Service Oriented Architecture (SOA) vulnerability?
Options
- ACross-site scripting
- BSQL injection
- CVPath injection
- DXML denial of service issues
How the community answered
(42 responses)- A5% (2)
- B5% (2)
- C2% (1)
- D88% (37)
Why each option
SOA environments rely heavily on XML-based messaging (SOAP, WSDL), making XML-specific attacks such as XML denial of service a common and significant vulnerability. Attackers can exploit malformed or recursively nested XML payloads to exhaust parser resources.
Cross-site scripting is a vulnerability in web application output rendering on the client side and is not specific to SOA or XML message processing.
SQL injection targets database query construction in applications and is not a vulnerability specific to SOA's XML-based service communication layer.
VPath injection is not a recognized standard vulnerability category in SOA or general web security frameworks.
XML denial of service is a well-known SOA vulnerability because SOA typically uses XML-based protocols like SOAP for inter-service communication. Attacks such as the XML bomb (billion laughs attack) or oversized XML payloads can cause XML parsers to consume excessive CPU and memory, resulting in service unavailability. This is unique to XML-heavy architectures like SOA and is not a general web vulnerability.
Concept tested: SOA XML-based denial of service vulnerabilities
Source: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/07-Testing_for_XML_Injection
Topics
Community Discussion
No community discussion yet for this question.