O My Data: OData Injection attack in Microsoft Power Platform and UiPath
summary
New protocol-level exploit called OData Injection targets Microsoft Power Platform and appears in UiPath connectors enabling data exfiltration and access-control bypass via crafted OData filter strings; demos show payloads sent with Postman and hex-encoded whitespace to evade crude sanitizers. Classic SQL injection resurfaces when flows use raw SQL actions, and a tar-based attachment name proves remote command execution in an RPA flow. Analysis of tens of thousands of apps finds scale: 50,000 automations / 5,000 exposed; author ships ppqa open source scanner to enumerate and triage the problem.
AI-written summary · about
chapters (17)
- 0:00OData injection research intro
- 1:06Research agenda and motivation
- 2:57What is OData in Power Platform
- 6:10OData query syntax and filters
- 8:46OData injection in Power Platform
- 11:53Demo of OData injection attack
- 14:28Bypassing sanitization with tabs
- 15:09SQL injection in automations
- 16:14SQL vs OData injection risks
- 18:50Internal automations as attack surfaces
- 21:54OData injection in UiPath
- 24:53Why injection persists in low-code
- 27:59Securing low-code challenges
- 31:18Remediation tips for developers
- 34:34PPQA security tool intro
- 36:22Risks and security integration
- 37:53Q&A
related talks
25mBack To The Future: Old Tricks Invading A New Attack Surface
36mGive Me a SQL Injection, I Shall PWN IIS and SQL Server
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
44mSure, Let Business Users Build Their Own. What Could Go Wrong?
30mAPI Security - Divide & Conquer
38mAll You Need is Guest