Zombie Endpoint / Orphan API Spec

ID

zombie_endpoint

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Family

API9:2023 - Improper Inventory Management

CWE

CWE-1059

Resource

inventory

Language

any

Description

Compares endpoints discovered from source-code analysis against endpoints declared in the project’s OpenAPI / Swagger descriptors. Emits two distinct flaw types:

  • zombie_endpoint — endpoint present in source code but missing from any descriptor (undocumented attack surface).

  • orphan_spec — endpoint declared in a descriptor but with no detectable handler in the source tree (false-advertising contract).

Path-parameter syntax is normalized before the join, so /users/{id} (OpenAPI), /users/:id (Express), /users/<int:id> (Django), and /users/[id] (Next.js) match. The detector fires only when both source code and a descriptor were discovered in the same scan — single-source projects cannot drift, so nothing is emitted.

Rationale

Drift between the advertised API (the OpenAPI / Swagger spec) and the implemented API (the running source) is a documented OWASP API9:2023 — Improper Inventory Management — risk. Both directions matter:

  • Zombie endpoints are reachable from the internet but the security team doesn’t know they exist. They’re skipped by API gateways, missed by DAST scans configured from the spec, and often run older versions of shared middleware than the documented routes. Most public breach studies that involve undocumented endpoints fall into this bucket.

  • Orphan specs lie to clients (and to auditors). They lead to integration bugs, broken DAST runs, and — when an orphan_spec describes a privileged operation — a confused-deputy problem where the spec implies a permission boundary that the implementation doesn’t enforce.

Drift is also a strong proxy for review hygiene: a codebase whose spec is in sync with handlers tends to have other security controls in place.

Remediation

For zombie_endpoint:

  • Document the endpoint in your OpenAPI / Swagger spec — including its security: requirement, request/response schema, and any rate-limit annotation.

  • Or, if the endpoint is genuinely dead code, remove the handler.

For orphan_spec:

  • Remove the orphan operation from the spec so it reflects reality.

  • Or, implement the missing handler if the spec is leading the implementation.

In both cases, treat code-vs-spec drift as a single PR — reconciling both sides at once avoids re-introducing the same drift in the next iteration. Wire the API security scan into CI so any new drift is caught at PR time.

Configuration

This detector does not require specific configuration. It activates automatically when a scan discovers both source-code endpoints and at least one OpenAPI / Swagger descriptor.

References