Powering up: Abusing Power Apps to compromise on-prem servers

Note: For the rest of this post, I’m going to use “connector” to describe the library of actions in Power Apps (ex: the Entra ID connector), and “connection” to refer to a connector that has been created and authenticated by a user…