Let's assume we have REST API in which you accept GET and POST HTTP requests without the ability to execute files.
- Is it possible to execute malware in this scenario?
- Would there be any justifiable benefit of malware scanning of such endpoints?
-
1AFAIK, the API is just an interface, which depending on the programming language and used frameworks might have their own bugs, but it rather can be used as a tool to exploit some resources/information/tokens that you shouldn't have given access to. There are lots of vulnerabilities which can lead RCE which can be achieved thru APIs.– Sir MuffingtonOct 17, 2021 at 16:52
-
1An API has a purpose. If the purpose of the API is to accept files and somehow process these, this "somehow process these" part might be affected by the malware or might be not, depending on what it does - which is unknown.– Steffen UllrichOct 17, 2021 at 16:56
Add a comment
|
1 Answer
The definition of malware per Google:
software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system.
It's really an argument of semantics, but "malware" is not really a threat to APIs, as in what is typically considered malware isn't really applicable to APIs, but malware can definitely be planted via vulnerable APIs. For example, achieving RCE via insecure deserialization could allow attackers to drop malware on the underlying host, but the malware has no natural or inherent relationship to the APIs.
Would there be any justifiable benefit of malware scanning such connections?
This is usually done, but worded in a different way. IPS (Intrusion Prevention) and IDS (Intrusion Detection) solutions, such as WAFs (Web Application Firewalls) perform similar behaviors. However, they aren't scanning for "malware" in the essence of "software", they're scanning for malicious HTTP requests. That being said, AVs and EDRs would still be beneficial in the case that malware is planted by way of an API vulnerability.
