Which XML-related threat category includes attacks like XML Bombs used to overwhelm parsers?

• A. SQL Injection
• B. XSS
• C. XXE
• D. XML Bombs

Answer: (D)

XML External Entity (XXE) vulnerabilities are about abusing how an XML parser handles entities and external references. An attacker can craft XML that defines entities pointing to local files or remote resources, and when the parser resolves these, sensitive data can be exposed or the system can be overwhelmed by resource consumption.

XML Bombs, such as the classic billions-of-laughs pattern, are a specific type of XXE attack that exploits explosive entity expansion to exhaust CPU and memory, leading to a denial of service. Because these attacks rely on manipulating the XML parser’s handling of entities and external references, they fall under the XXE category. Other threats like SQL injection or XSS target different parts of an application and do not involve XML parser entity processing in the same way. To mitigate XXE, disable external entity processing when possible, use secure XML parsers, apply resource limits, and validate or sandbox inputs.