Question: when studying about xml vulnerabilities , i came accross coercive parsing attack.
can anybody say what exactly is Coercive parsing attack(in SOA applications). How does the attack take place? How can one implement this attack using xml parser in java?

Answer: 
For an example implementation of this attack, see the "Billion Laughs Attack."

For a full discussion of the attack, how to test for it, and basic defenses, see the ["Web Security Testing Cookbook" recipe on Malicious XML.](http://books.google.com/books?id=VmrSJ3V-s_MC&lpg=PT116&dq=web%20security%20testing%20cookbook%20billion%20laughs&pg=PT116#v=onepage&q=web%20security%20testing%20cookbook%20billion%20laughs&f=false) (Free Google Preview - it's only 3 pages). An excerpt:

"This billion laughs attack abuses the tendency of many XML parsers to keep the entire structure of the XML document in memory as it is parsed ... enough to exhaust a vulnerable program's available memory."

Here's a few other resources:

<http://www.ibm.com/developerworks/xml/library/x-tipcfsx.html>

<http://en.wikipedia.org/wiki/Billion_laughs>
Generally applications use document type definitions(DTDs) for backward compatibility.  
 XML definitions allow the use of element "CDATA" which allows illegal characters '<','&'.   
 **All text in an xml document will be parsed by parser. But text inside te cdata section will be ignored by parsers which allows the attackers to send possible system commands to the underlying systems and can sneak in system commands that could potentially be disastrous, they could allow the attaker to manipulate the host with a series of commands.**
They could also be used for injection attacks like xpath injection attacks.