Low Code High Risk: Enterprise Domination via Low Code Abuse

Low Code High Risk: Enterprise Domination via Low Code Abuse

Speakers: Michael Bargury, Lead, Zenity

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=j0uUpsuUoFQ

Overview

In an era where digital transformation is paramount, low-code and no-code platforms have emerged as powerful tools, empowering business users—often termed citizen developers—to rapidly build applications and automate workflows without extensive programming knowledge. This talk by Michael Bargury, a leading expert in low-code/no-code security and head of the OWASP Low-Code/No-Code group, critically examines the profound security implications of this burgeoning trend. Bargury argues that while these platforms offer undeniable productivity benefits, their rapid proliferation, inherent design choices, and lack of traditional security oversight create significant, often unseen, risks that attackers are already exploiting.

The core premise of the presentation is that low-code environments, by design, facilitate "credential sharing as a service," bypassing established security models and rendering conventional defenses ineffective. Bargury illustrates how these platforms, deeply integrated into enterprise SaaS ecosystems like Microsoft 365, Salesforce, and ServiceNow, become fertile ground for privilege escalation, data exfiltration, sophisticated persistence mechanisms, and even the deployment of malware through trusted channels. The talk serves as a stark warning to security professionals, urging them to proactively address this underrated attack surface before organizations face severe consequences.

Background

▶ Watch: Introduction: Low-code empowers, but poses risks (0:00)

The rise of low-code/no-code platforms is a direct response to a persistent organizational challenge: the perennial scarcity of IT resources and the increasing demand for tailored business applications. Traditional software development lifecycles (SDLCs) are often slow and resource-intensive, leading to backlogs and missed opportunities. Low-code platforms promise to bridge this gap by enabling business users to develop solutions for their specific needs, thereby accelerating innovation and efficiency. This concept is not entirely new; tools like Microsoft Excel with its macro capabilities have long empowered business users, albeit with their own set of security concerns.

However, the modern iteration of low-code/no-code is vastly different in scale and scope. Platforms like Microsoft Power Automate, Power Apps, Salesforce Flow, and Zapier are deeply embedded within critical enterprise SaaS environments. They connect to sensitive business data, orchestrate complex workflows, and run within the cloud infrastructure of major vendors. This ubiquity means that if an organization uses any of the top enterprise SaaS platforms, low-code capabilities are almost certainly present and actively used, often without the explicit knowledge or oversight of IT and security teams. The sheer volume of applications being created—thousands in a single Fortune 500 company, as highlighted by Bargury—overwhelms traditional security approaches like manual reviews, threat modeling, and vulnerability management. Furthermore, the recent integration of AI capabilities, such as ChatGPT into platforms like Microsoft 365, makes app creation even easier, accelerating this proliferation. The challenge is compounded by the fact that these applications run as SaaS, making them notoriously difficult to monitor and control using conventional network or endpoint security tools. Security teams often underestimate the power and reach of these "citizen-built" applications, treating them as mere "toys" rather than potential entry points or exfiltration vectors for critical business data.

Key Findings

▶ Watch: Unprecedented scale of citizen development apps (2:18)

Michael Bargury's presentation unveiled several critical security findings inherent to low-code/no-code platforms, demonstrating how they create a novel and often overlooked attack surface:

1. Credential Sharing as a Service: A fundamental design flaw in many low-code platforms is the ability to share connections—effectively OAuth refresh tokens—between users. This bypasses the traditional OAuth permission model, allowing one user to impersonate another and act on their behalf with the full scope of the original user's permissions, leading to widespread privilege escalation.
2. Living Off the Land Attacks: Low-code applications, running on trusted cloud infrastructure and using legitimate integrations, are ideal for "living off the land" attacks. Attackers can leverage existing, often over-privileged, connections to perform malicious actions that blend seamlessly with legitimate business operations, making them extremely difficult to detect.
3. Data Exfiltration and Ransomware-like Capabilities: The platforms provide functions for file manipulation, email sending, and data transfer, which can be maliciously repurposed. Bargury demonstrated how an attacker could encrypt all files in a SharePoint site or exfiltrate corporate emails to a personal Gmail account, all executed within the trusted environment of the low-code platform.
4. RPA-based Malware: Robotic Process Automation (RPA) components, such as Power Automate Desktop (pre-installed on Windows 11), can be leveraged to create malware. These bots emulate user input on a local machine, using trusted executables and communicating over trusted Microsoft domains, making traditional endpoint and network defenses ineffective.
5. Internal Phishing Campaigns: Low-code platforms can host applications on trusted vendor domains (e.g., microsoft.com), enabling highly convincing internal phishing campaigns. Users are prompted to log in with their corporate credentials and grant broad permissions (e.g., "access to Outlook") without granular visibility into the specific actions the app will perform. A configurable "bypass consent flow" flag in some platforms exacerbates this risk.
6. Advanced Persistence Mechanisms: An Advanced Persistent Threat (APT) group was observed using Microsoft Power Automate as a persistence mechanism. They created a scheduled automation to perform e-discovery, exfiltrating sensitive data and PII for six months undetected. Bargury further demonstrated a more sophisticated backdoor that could create, run, and delete automations along with their logs, leaving no trace.
7. Predictable Misconfigurations: Just like open S3 buckets, low-code platforms suffer from predictable misconfigurations. Examples include:

• Microsoft Power Pages (formerly Power Portals): Default settings historically exposed entire SQL databases, including authentication tokens and API keys, to anonymous users via a REST API endpoint.
• Zapier Storage by Zapier: A key-value store intended for automation state, where the required secret key was a GUID but documentation examples led users to employ weak, easily guessable keys (e.g., "12345"), allowing for unauthorized data access via enumeration attacks.

Technical Deep Dive

▶ Watch: Why low-code exists: Bridging IT and business needs (4:00)

The technical underpinnings of low-code/no-code security vulnerabilities are rooted in the fundamental architecture and operational model of these platforms. At their core, low-code tools like Power Automate, Zapier, and others function as sophisticated "if this then that" (IFTTT) engines, enabling connections between disparate services and automating actions.

The crucial concept is connections. When a user integrates a service (e.g., Slack, Outlook, SharePoint, AWS) into a low-code application, they undergo an OAuth consent flow. This grants the low-code platform (e.g., Zapier) permission to act on the user's behalf. Crucially, the platform often stores the refresh tokens obtained during this flow. The problematic design choice is the ability to share these active connections with other users within an organization. This effectively turns the platform into a "credential sharing as a service," allowing any user with access to a shared connection to impersonate the original user and perform actions with their full permissions. This completely breaks the traditional security model of OAuth, where consent is typically tied to a specific application and user.

Attackers can leverage this "credential sharing" for privilege escalation. A low-privilege guest account, for instance, might gain access to a platform's default environment where highly privileged connections (e.g., to an admin's Outlook or Azure account) have been shared. With a single click, the attacker can "pick up" these connections and operate with elevated privileges.

For data exfiltration and ransomware-like attacks, the platforms provide native functions. Bargury demonstrated an attack on SharePoint: an automation could be configured to iterate through files, use a platform-provided encryption function (intended for legitimate use cases), and then overwrite the original files with the encrypted versions. This attack would bypass traditional network and endpoint ransomware detections because it occurs entirely within the trusted cloud environment, using legitimate platform functions and the user's own identity. Similarly, an email exfiltration flow could connect to a corporate email account (via a shared connection) and a personal Gmail account (via another connection), then forward sensitive content directly on the vendor's cloud infrastructure, bypassing DLP or email server monitoring.

The concept of RPA malware extends these capabilities to the endpoint. Microsoft Power Automate Desktop, pre-installed on Windows 11, allows users to automate desktop actions (mouse clicks, keyboard input). An attacker could attach a user's local Power Automate instance to their malicious cloud, sending payloads that execute as trusted Microsoft executables, communicating over trusted Microsoft domains. This makes detection via network IOCs or suspicious executables extremely challenging, as the activity appears legitimate.

Internal phishing campaigns are facilitated by the fact that low-code applications are often hosted on subdomains of major vendors (e.g., portal.microsoftcrmportals.com). An attacker with an initial foothold (even a guest account) can create a seemingly innocuous app (e.g., an "out-of-office" utility). When a target user clicks a link to this app (which appears to be a legitimate Microsoft URL) and logs in, they are prompted to connect their services (e.g., Outlook). Crucially, the consent dialog often only shows the service (e.g., "Outlook"), not the granular permissions or the malicious actions the app will perform. Once connected, the attacker's app can then perform actions like sending emails on the user's behalf. The risk is compounded by a configurable "bypass consent flow" flag in some Microsoft platforms, which, if enabled, removes this last interaction, allowing immediate, silent compromise upon clicking the link.

For persistence, Bargury detailed an APT group's use of Power Automate. They gained access to an admin's account and created a scheduled flow that used the e-discovery feature of Office 365 to find secrets and PII, then exfiltrated them to an external endpoint. This went undetected for six months because security teams weren't monitoring low-code platforms. Bargury then demonstrated a more sophisticated backdoor using the Power Automate management connector. This tool creates a temporary automation (with arbitrary payloads), executes it, and then deletes the automation along with all associated logs. This leaves no trace of the malicious activity within the platform's native logging, making attribution and detection nearly impossible. The backdoor is triggered via an HTTP webhook endpoint with a hardcoded secret.

Finally, predictable misconfigurations are a recurring theme. Microsoft Power Pages (formerly Power Portals) historically defaulted to exposing entire SQL databases, including sensitive authentication tokens and API keys to Azure, via an anonymous REST API endpoint (/api/data). Attackers could use basic subdomain enumeration (e.g., via Bing searches for site:*.microsoftcrmportals.com) to discover vulnerable portals and query their APIs for sensitive data. Similarly, Zapier's "Storage by Zapier" service, a key-value store, was designed to use GUIDs as secret keys. However, poor documentation examples led users to choose weak keys (e.g., "12345"), which could be brute-forced or enumerated to gain unauthorized access to stored data, including API keys and user credentials. Critically, many of these old, weak keys remain active even after Zapier updated its key generation requirements.

Demo / Proof of Concept

▶ Watch: Diverse capabilities of low-code applications (5:20)

Michael Bargury's presentation was rich with practical demonstrations and proof-of-concept (PoC) scenarios, illustrating the ease with which low-code platforms can be weaponized.

He began by showcasing the simplicity of building an automation using Zapier. He created a flow where, if he was mentioned on Slack, his status would automatically change to "on a call" for five minutes, then revert. This quick demonstration (taking about two minutes to build and deploy) highlighted that users require no coding, directly interact with APIs without explicit credential handling, and deploy applications instantly to production without an SDLC or security gates. The critical point was the "connection" object created through an OAuth consent flow, which could then be shared.

Next, Bargury demonstrated a ransomware-like attack on SharePoint. He showed an automation where a button click would iterate over files in a SharePoint site, encrypt each file using a platform-provided encryption function, and then overwrite the original file. This illustrated how malicious functions could be executed within the trusted low-code environment, bypassing traditional ransomware defenses.

A common data exfiltration scenario was also demonstrated: an automation connecting to a corporate email account on one side and a personal Gmail account on the other. The flow would simply copy email content between the two, with the data transfer occurring on the SaaS vendor's cloud, making it invisible to network security appliances. He also cited examples of syncing corporate drives with personal drives, or using personal cloud storage (e.g., Excel on a personal OneDrive) as a database for a shared business application.

For internal phishing, Bargury demonstrated creating an "out-of-office" application hosted on a Microsoft domain. The app, when accessed by a user, would prompt them to connect their Outlook account. Once connected, the attacker's app would then send an email from the victim's account to the attacker, stating "I've been pwned." He specifically highlighted the consent window that appears, which typically only lists the service (e.g., "Outlook") rather than granular permissions, and warned about the "bypass consent flow" flag that can eliminate this final user interaction.

The persistence section included a rudimentary PoC of the APT group's attack. Bargury built a Power Automate flow that ran on a schedule, looped through a SharePoint site, encrypted files, dumped them to an HTTP endpoint, and even "tweeted about it." This showcased how simple scheduled automations could be used for long-term data exfiltration or sabotage.

While not a live demo, Bargury introduced a conceptual backdoor tool for Microsoft 365. This Python script, leveraging the Power Automate management connector, would install an HTTP endpoint. When triggered, it would dynamically create, execute, and then delete an automation (along with its logs) in the target organization's Power Automate instance. This "ephemeral" execution leaves no trace, offering robust and stealthy persistence. The talk also mentioned upgrades, a tool available on GitHub that uses the unofficial Zapier API to enumerate connections available to a user, helping identify over-privileged or shared credentials. Another tool mentioned, "no-code malware," allows leveraging RPA for Windows 11 malware.

Finally, Bargury demonstrated the Zapier Storage misconfiguration. He showed an API query for Zapier's key-value store using a weak, easily guessable key like "12345". The response, containing sensitive data such as authentication tokens and API keys, confirmed the vulnerability stemming from users adopting insecure keys based on misleading documentation examples.

Defensive Implications

▶ Watch: Low-code adoption is inevitable for enterprises (6:05)

Addressing the security risks posed by low-code/no-code platforms requires a fundamental shift in how organizations approach enterprise security. Traditional network and endpoint defenses are often blind to these threats, as malicious activity occurs within trusted SaaS environments using legitimate user identities and platform functionalities. Michael Bargury outlined several crucial defensive implications and actionable recommendations:

1. Inventory and Visibility: The first and most critical step is to gain visibility into the low-code landscape. Organizations must inventory all low-code applications, understand who built them, what data they access, and what operations they perform. Without knowing what needs to be protected, effective defense is impossible. This includes identifying all connections and their associated permissions.
2. Engage with Citizen Developers and Platform Managers: Security teams need to move beyond traditional "block and ban" approaches. Instead, they should proactively engage with business users and the teams managing low-code platforms. These individuals are often aware of the risks but lack security guidance. Collaborating with them to embed security best practices early in the development process ("shift left") is essential.
3. Review and Harden Platform Configurations: Low-code platforms, like any powerful system, have numerous configuration options that can significantly impact security. Defenders must meticulously review these configurations:

• Connector Usage: Understand which connectors are enabled and who has access to them. Restrict access to highly privileged connectors where possible.
• Open Endpoints: For platforms like Power Pages, ensure that public-facing API endpoints do not expose sensitive business data to anonymous users by default or through misconfiguration.
• Bypass Consent Flow (Microsoft Power Platform): This is a critical setting. Ensure that the flag allowing applications to bypass user consent for connections is disabled. This forces users to explicitly acknowledge the services an app will connect to, even if the permissions aren't granular.
• Default Environments: Scrutinize "default environments" where all users can create and share applications and connections. Implement stricter controls or create dedicated, secured environments for critical applications.

1. Enhanced Logging and Monitoring: Default logging in many low-code platforms is insufficient for security investigations. Organizations should actively configure platforms to route logs to a separate, centralized security information and event management (SIEM) system or storage account. This ensures that even if an attacker deletes an automation (as seen with the advanced persistence PoC), the logs of its execution are retained for forensic analysis. While some Graph API activities might be logged, many Power Platform-specific API calls are not logged by default, requiring proactive configuration.
2. Leverage OWASP Top 10 for Low-Code/No-Code: This dedicated project provides a comprehensive framework for understanding and mitigating low-code security risks. It offers specific examples of vulnerabilities (often related to business logic rather than traditional code flaws) and provides a common language for security teams to communicate these risks to business users and leadership.
3. User Education and Awareness: While citizen developers shouldn't be expected to be security experts, basic awareness training on the risks of sharing connections, clicking suspicious links (even on trusted domains), and the implications of granting broad permissions can help mitigate some threats.
4. Automated Security Tools: As the number of low-code applications grows, manual review becomes impossible. Organizations need to invest in automated tools (like Bargury's upgrades tool) that can scan for misconfigurations, identify over-privileged connections, and monitor for suspicious activity within low-code platforms.

Key Takeaways

• Low-code/No-code platforms are ubiquitous and rapidly expanding, integrating deeply with critical enterprise SaaS environments, often without adequate security oversight.
• "Credential sharing as a service" is a fundamental design flaw, enabling broad user impersonation and privilege escalation by allowing refresh tokens to be easily shared between users.
• Traditional security controls are often blind to low-code attacks, as malicious activities occur within trusted cloud environments using legitimate identities and platform functions, bypassing network and endpoint defenses.
• Attackers can achieve diverse objectives, including data exfiltration (e.g., corporate to personal cloud), ransomware-like actions (e.g., SharePoint file encryption), internal phishing via trusted domains, and sophisticated, log-less persistence.
• Predictable misconfigurations persist, such as default-open APIs exposing sensitive data (Power Pages) or weak key management leading to enumeration vulnerabilities (Zapier Storage).
• Proactive defense is crucial, requiring inventory of applications, engaging with citizen developers, meticulously reviewing platform configurations (especially consent flows and data exposure settings), and implementing enhanced, separate logging mechanisms.

About the Speaker(s)

Michael Bargury is a prominent figure in the field of low-code/no-code security. He currently leads Zenity, a company focused on securing this emerging technology landscape. Bargury is also at the forefront of community efforts, leading an OWASP group dedicated to defining the top security risks for low-code/no-code applications, an initiative that has garnered over 200 participants. His expertise in this domain spans approximately four years, building upon a prior role at Microsoft, where he was part of the team responsible for creating new security products such as Defender for APIs and Defender for IoT. Michael Bargury is also a prolific writer on the topic, contributing to a deeper understanding of low-code security challenges and solutions.