AI
OData: Power Platform’s Ubiquitous Data Protocol
OData is an OASIS standard for managing data over REST APIs using JSON on HTTP. Microsoft built it into Power Platform as the transport layer for connectors, the web services that link flows and apps to external data sources like SQL, SharePoint, Salesforce, and Dataverse. Each connector exposes an OData filter parameter that accepts boolean expressions, comparison operators, and string functions. When a flow’s filter expression incorporates user input without sanitization, the attacker controls which records come back.
OData Filter Injection and Data Exfiltration
A sample flow queries order history from a database. The authenticated user’s email, pulled from Active Directory, constrains results to that person. But users also supply a product name as input, and that input feeds directly into the OData filter string. Shulman enters a crafted expression instead of a product name. The filter restriction on the email field collapses. The flow emails him every order from every user in the organization. The flow runs under the creator’s database credentials, so the attacker never needs direct database access.
Bypassing Sanitization at the Protocol Level
A second flow adds code to strip spaces from user input. OData filter syntax requires spaces between tokens, so the injection should fail without them. Shulman captures the API request, opens a hex editor, and replaces every space byte with a tab character. OData parsers accept tabs as token separators. The sanitizer sees no spaces to remove. The injection works. This bypass mirrors a known SQL injection technique, but the defense literature for OData does not cover it, and the platform provides no built-in escaping mechanism.
Classic SQL Injection in Power Platform’s Direct SQL Query Action
Some Power Platform developers bypass the get-rows connector and write SQL queries directly, often to join tables or apply complex filters. The SQL query action concatenates user input into the query string with no parameterization. Classic SQL injection results. Unlike OData, this vector has a documented fix: the Power Platform interface supports parameterized queries. The option is present but poorly documented and awkward to use. Developers who find it can prevent injection; most never look.
Email Attachments as a Command Injection Vector in UiPath
Shulman wrote a UiPath automation to download email attachments and compress them using tar. He shared it enterprise-wide. The attachment filenames feed directly into the tar command line with no sanitization. An attacker sends an email with a malicious filename containing shell metacharacters. When any employee runs the automation, the OS executes the attacker’s code on their machine. The attack surface is an ordinary inbox. The automation was flagged as convenient and internal, so no one scrutinized it.
Scale and Missing Tooling Create Systemic Injection Risk
Three factors create the systemic problem. First, scale: enterprises generate more automations than ever, built by non-engineers who have no security training. Second, speed: Power Automate flows deploy the moment they are saved, with no deploy gate and no review queue. Third, tooling: SAST and peer code review never reach low-code output because it has no source code. One organization thought it had 1,000 automations. It had 50,000. Security teams are often unaware the automations exist, let alone what data they access.
Q&A
Has AI copilot use accelerated the spread of insecure no-code automations? Software engineers show skepticism and review copilot-generated code; citizen developers do not ask questions if the automation works. ▶ Watch (38:14)
Do all RPA platforms use OData? Power Platform is the heaviest user. UiPath also uses it. Any new data-access method a platform introduces creates a new injection threat if user input reaches it unsanitized. ▶ Watch (39:42)
How large is the risk, and can non-engineers be trained to write securely? At least 10% of low-code automations accept external input. Security education does not scale to the whole organization. The better goal is fast, direct communication to correct individual mistakes before they age. ▶ Watch (41:17)
Does the PPQA open-source tool detect injection vulnerabilities? No. It sizes the environment and surfaces general configuration issues, but does not scan individual flows for injection patterns. ▶ Watch (46:09)
Notable Quotes
does that look familiar to you and now Amichai Shulman · ▶ Watch (14:00)
This is not just a potential issue Amichai Shulman · ▶ Watch (21:15)
code that’s the hard reality Amichai Shulman · ▶ Watch (43:17)
Key Takeaways
- OData injection affects every data-providing Power Platform connector, with no built-in escaping mechanism.
- Tab characters bypass space-stripping sanitization because OData parsers accept both as token delimiters.
- Classic SQL injection still appears when developers use direct SQL query actions without parameterization.
- Command injection through email attachment filenames turns any shared UiPath automation into a code execution risk.
- At least 10% of low-code automations accept external input, and no standard security toolchain scans them.
- Timely, direct communication to the automation creator beats security education campaigns that cannot scale.
About the Speaker(s)
Amichai Shulman is CTO and co-founder of Nokod Security. He has more than 30 years of cybersecurity experience across military, government, and commercial environments, and co-founded Imperva in 2002, where he served as CTO.