Back To The Future: Old Tricks Invading A New Attack Surface
summary
Demoed Power Automate SQL+HTML injection that lets a public form exfiltrate database fields and send phishing HTML from an internal address, a UiPath package executes on add so a crafted filename triggers local CMD actions, and a dependency‑confusion chain using NuGet/marketplace uploads — research finds 20 vulnerable dependencies, 4 exploitable — plus an OutSystems Forge package that auto‑adds users who immediately gain access. Fixes shown: restrict feeds, pin versions, use prepared statements/encoding, and automate detection rather than manual review.
AI-written summary · about
chapters (9)
- 0:00No-code low-code platforms
- 2:12Security challenges in no-code
- 5:25SQL injection in Power Automate
- 9:26Command execution via UIPath
- 11:55Supply chain attacks in low-code
- 14:24Dependency confusion in UIPath
- 19:38Privilege escalation in OutSystems
- 22:53Mitigation strategies
- 24:00Future of citizen-developed apps
related talks
48mO My Data: OData Injection attack in Microsoft Power Platform and UiPath
44mWhen you can't afford 0days: Client-side exploitation for the masses
43mHunting for Bugs, Catching Dragons
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming
50mStranger Danger: Your Java Attack Surface Just Got Bigger
51mOffice in Wonderland
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
25mPreventing an OWASP Top 10 in the world of AI