Can you get a virus from sending a GET or POST request? [duplicate]

Question

If I need to fix up my question in any way please let me know, this is my first question on the site

So there's a game development website I use where you can develop with other people, and within the past few months they introduced a new feature where you can get into the editor with other people. Now, here's the thing. They heavily sandbox things, and for good reason, so in game you can't send http requests from a user's computer, but due to how the game creation tool works, there's a small bug that would allow you to do this.

The worst thing I've thought of being able to do with this is snag someone's IP, which isn't exactly a terrible thing, it's a public IP afterall, but I'm curious if it's possible to infect their computer, give them a virus, or anything else damaging, just by having them send a GET/POST request to a website, and if so how this would work?

I want to convince the creators/designers of the site and development tools to make a fix for this, and a real threat would help my argument a lot. But I can't make the claim without evidence. Is there any real threat to the person sending the request here?

Answer 1

Yes, it depends how that GET/POST request is handled on the receiving party, i.e the client.

While explained in another thread "Yes, you can get a virus just by visiting a site in Chrome or any other browser". This also counts for any client. In this case: the program that's handling the response from your web request. No matter if that's a browser, CLI program, library, game, etc. If a vulnerability exist in the client code which can be exploited, malicious code can be executed. This malicious code is roughly what you refer to as "a virus".

There are mitigating factors such as isolation, exploit mitigation (DEP, ASLR, ...) but there's always a possibility that this is bypassed.

The worse thing that can happen is that an attacker can execute code on a victims machine, elevate privileges and execute system commands. Examples? Steal data, delete files, launch further attacks, ... If someone can execute code it's a complete compromise.