Your RPA is Mine: Complete Takeover of RPA Ecosystems

by Alon Dankner

Day 1 · Room: Supreme Court · Breakout Track: Breaker · 39 min · 4 min read

Application Security Offensive Security

TL;DR

Alon Dankner demonstrated a complete supply chain attack against UiPath RPA. By exploiting a command injection in a public-facing automation, an attacker steals the machine key stored in plaintext in serverless environment variables. That key unlocks the organization's NuGet package feed. An attacker can replace any automation package with a malicious version, distributing malware to every machine that runs it. The same path works on Windows desktops via DPAPI decryption. Large organizations run tens of thousands of such automations.

RPA as an Unmonitored Attack Surface

▶ Watch (4:19)

RPA platforms like UiPath let business users automate tasks across databases, ERP systems, CRM platforms, drives, and mailboxes. Large organizations run tens of thousands of these automations. Some respond to external emails or HTTP requests, making them public-facing. Unlike traditional web applications, RPA environments have almost no security monitoring. No code review. No visibility into what data passes through them. Most organizations cannot answer how many automations they have, or what systems those automations can reach.

Building a Research Shell Inside a Locked Container

▶ Watch (8:45)

UiPath serverless runs Linux containers with no SSH and no access to internal OS resources. Unlike Windows VMs that support RDP, serverless offers no direct access path. To explore the environment, the researchers built two automations: one on the serverless to execute Linux commands, one on a laptop to communicate via Google Drive. Basic commands like ifconfig were missing, so static self-contained binaries were bundled into the package. A 15-minute session cap forced them to dump the filesystem to a text file for offline analysis.

The Machine Key in Plain Sight

▶ Watch (15:09)

After scanning for SUID root binaries, private keys in the filesystem, and known CVEs with open-source tools, the researchers found nothing. The serverless seemed locked down. Then they checked environment variables. The machine key sat there in plaintext. Despite the misleading name, this key authenticates with the UiPath orchestrator. Using it, an attacker calls the UiPath API to retrieve service settings, which contain a second key: the NuGet package feed key for the entire organization.

Infecting the Package Feed

▶ Watch (16:29)

The NuGet feed key lets an attacker download any automation package, inject malicious code into its DLLs, and republish it under the same name and version. Every machine that runs that automation pulls the infected build. A grafting technique adds a jump to malicious code at the start of the workflow: malicious activity executes, the automation continues normally, nothing appears broken. A separate evasion swaps in a malicious binary while keeping the original source code. Anyone reviewing the package sees clean code.

Desktop Machines Fall the Same Way

▶ Watch (28:32)

UiPath Assistant on Windows stores the machine key in a settings file, encrypted with Windows DPAPI (CryptProtectData), tied to user credentials and the TPM. An attacker running malicious code already has user-level permissions, so calling CryptUnprotectData decrypts the key without additional privilege escalation. The same feed infection chain then follows. Desktop automations carry higher risk because non-technical users often download components from public marketplaces without scrutiny, making malicious third-party packages a realistic initial access vector.

What UiPath Fixed and What Customers Must Do

▶ Watch (33:47)

UiPath removed the machine key from serverless environment variables. The researchers also recommend: separate read and write keys for the package feed, block deletion of existing package versions, and enable secure deployment configuration, which replaces feed keys with user authentication. Customers should scan RPA automations for vulnerabilities, the same way they scan traditional application code. Package signatures prevent feed tampering but require active certificate management to be effective. Anyone with a Microsoft 365 license can access Power Automate today.

Q&A

Is it intentional for UiPath to allow personal environment machines to upload packages to the feed? Key permissions could be split into separate read and write operations to reduce the blast radius of a compromised key. ▶ 37:23

How far does the feed infection actually spread? Infecting the package feed reaches every machine that subsequently runs any of those packages. ▶ 38:15

Notable Quotes

So there’s uh little to none visibility. Alon Dankner · ▶ 5:00

like hiding a key under the doormat. Alon Dankner · ▶ 15:36

orchestrator into a huge malware center Alon Dankner · ▶ 17:54

steals the feed key, infects the entire Alon Dankner · ▶ 31:24

Key Takeaways

A single machine key in serverless environment variables unlocks the entire organization’s automation feed.
The grafting technique runs malicious code silently while the automation appears to work normally.
Swapping binaries while keeping original source code defeats package review without triggering alerts.
Desktop machine keys encrypted with DPAPI are still recoverable by any code running as that user.
UiPath’s secure deployment configuration removes feed keys entirely by using user authentication instead.

About the Speaker(s)

Alon Dankner is a security researcher at Nokod Security, a low-code/no-code cybersecurity startup. He holds a B.Sc. in Computer Science from the University of Haifa (cum laude) and an M.Sc. from the Technion (cum laude). This research was conducted jointly with Amika Schulman and students from the Technion.

Filed under

Application Security Offensive Security