Salesforce Experience Cloud Data Theft Attacks

City-Forum Data Theft Campaign Targets Salesforce Experience Cloud

A sophisticated data theft campaign, identified as ‘City-Forum’ by security firm Reco, is actively exploiting Salesforce Experience Cloud portals. This campaign leverages custom tools to exfiltrate data exposed to anonymous users, with over 560,000 breach events recorded.

Attack Vector and Infrastructure

The attacks originate from a single server associated with the IP address 158.220.87.79 and typically employ the Go-http-client/1.1 user agent. The associated domain, named ‘city-forum’, has been active for over a year. Reco has observed that current activities primarily target guest user access, though authenticated user compromise has not been ruled out.

Exploitation of Experience Cloud Guest User Permissions

Salesforce Experience Cloud relies on guest accounts to manage unauthenticated users. Misconfigurations in these guest user permissions can inadvertently expose data records to unauthorized access. The City-Forum campaign is specifically targeting the Aura component framework within Experience Cloud, a framework previously implicated in data breaches by groups like ShinyHunters.

Aura's streamlined access process, due to its single endpoint architecture, makes it a prime target. Reco reports that a single target instance logged over 560,000 guest Aura enumeration events during the campaign window.

Beyond Aura, the campaign also targets sites built with the Lightning Web Runtime (LWR) framework. Attackers use Salesforce's UI API, coupled with GraphQL requests to endpoints like /webruntime/api/services/data/{version}/graphql, to extract data from guest-accessible accounts. Additionally, attackers scan for /SiteRegister and /CommunitiesSelfReg endpoints to identify enabled self-registration features, which could grant guest users further data access.

Salesforce has stated that these attacks do not exploit vulnerabilities within their platform. Instead, they exploit data exposed due to overly permissive sharing rules, object/field-level permissions, or portal configurations assigned to guest user profiles.

Threat Actor and Campaign Scope

Reco has not identified the specific threat actor behind the City-Forum campaign. While similarities exist with previous ShinyHunters campaigns, the infrastructure used is generic hosting, not tied to any known group. The consistent use of a single Go binary targeting both Aura and LWR on Salesforce, and also impacting ServiceNow from the same source, suggests a custom, multi-platform toolset.

Remediation and Best Practices

Reco recommends implementing the principle of least privilege for guest users:

• Review Guest Sharing Rules: Remove any rules that grant the Guest User access to records beyond what is necessary for public display.
• Strip Permissions: Remove unnecessary object and field-level permissions, as well as the ‘Access Activities’ permission, from guest profiles.
• Disable Self-Registration: Turn off self-registration functionality unless it is absolutely critical for your portal's operation.
• Disable Guest Access to UI-API (LWR): In Experience Builder, navigate to Workspaces → Administration → Preferences and uncheck ‘Allow guest users to access public APIs’ for LWR sites.

Key Takeaways

• The 'City-Forum' campaign targets Salesforce Experience Cloud guest users by exploiting misconfigurations, not platform vulnerabilities.
• Attackers leverage custom tools to access data exposed through overly permissive guest user profiles and sharing rules.
• Both Aura and LWR frameworks within Experience Cloud are targets, with a focus on guest user data enumeration and UI API access.
• Implementing the principle of least privilege for guest users is crucial for mitigating these risks.
• Disabling unnecessary self-registration and restricting UI API access for guest users are key protective measures.