Let's assume we have REST API in which you accept GET and POST HTTP requests without the ability to execute files.
- Is it possible to execute malware in this scenario?
- Would there be any justifiable benefit of malware scanning of such endpoints?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The definition of malware per Google:
software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system.
It's really an argument of semantics, but "malware" is not really a threat to APIs, as in what is typically considered malware isn't really applicable to APIs, but malware can definitely be planted via vulnerable APIs. For example, achieving RCE via insecure deserialization could allow attackers to drop malware on the underlying host, but the malware has no natural or inherent relationship to the APIs.
Would there be any justifiable benefit of malware scanning such connections?
This is usually done, but worded in a different way. IPS (Intrusion Prevention) and IDS (Intrusion Detection) solutions, such as WAFs (Web Application Firewalls) perform similar behaviors. However, they aren't scanning for "malware" in the essence of "software", they're scanning for malicious HTTP requests. That being said, AVs and EDRs would still be beneficial in the case that malware is planted by way of an API vulnerability.