Salesforce Experience Cloud and ServiceNow customer portals have been targeted in an ongoing data theft campaign, dubbed ‘City-Forum’ by AI security firm Reco, which has been tracking the attacks.
These attacks have been carried out through the use of custom tools to steal data exposed to anonymous users, and the number of breaches is said to total over 560,000.
Details of the Attacks
According to Reco, the attacks have been traced back to a single server that has targeted multiple organizations, including Salesforce and ServiceNow. The security company alleges that the scale of the attacks is continuing to increase.
The breach campaign originates from the IP address 158.220.87.79, and almost always uses the default Go-http-client/1.1 user agent when downloading data. This particular IP address is associated with a domain using the “city-forum” name, which has been active for over a year.
Reco shared that so far, only guest user activities have been observed – not an authenticated user – but that the possibility of this could not be ruled out.
SF Ben has reached out to Reco for comment.
Breaching Experience Cloud
Salesforce’s Experience Cloud uses guest accounts to manage unauthenticated users, and it’s through these permissions that data records can be accessed by anyone if the permissions aren’t configured correctly.
According to Reco, Aura – the older of Experience Cloud’s two component frameworks – is being targeted especially. Aura has been linked to previous data breaches, including a previous Experience Cloud campaign executed by hacking group ShinyHunters.
As Aura’s framework only has one endpoint, the process to access records is a fairly streamlined process. Reco claims that this process is the one undertaken the most by the threat actor, with the busiest target having logged over 560,000 events from this IP across the campaign window, with nearly all of it being guest Aura enumeration.
The scope of the City-Forum campaign extends beyond these Aura endpoints, however, as threat actors have also been observed focusing on sites developed with the modern Lightning Web Runtime (LWR) framework. In these instances, attackers leverage Salesforce’s UI API to extract data from guest-accessible accounts, utilizing GraphQL requests directed to the /webruntime/api/services/data/{version}/graphql endpoint.
The attacker also checks Experience Cloud sites for /SiteRegister and /CommunitiesSelfReg endpoints. They do this to see if self-registration is turned on, which could let a guest user create their own account and get access to further data.
A Salesforce spokesperson told SF Ben that Salesforce was “aware of Reco’s research” and the fact that this issue stems from misconfigurations, such as overly permissive guest user profiles, rather than from a Salesforce vulnerability.
“These attacks are not exploiting a vulnerability in Salesforce,” they said. “Instead, they steal data that organizations have mistakenly exposed to unauthenticated guest users through overly permissive sharing rules, permissions, or portal configurations.”
“We continue to work with the security research community to enhance protections and educate our customers as these threats evolve.”
Who Is Behind the Campaign?
At this stage, Reco admits that it “[doesn’t] know who this is, and [that it’s] not ruling anyone in or out.”
Although this particular campaign bears similarities to those of previous ShinyHunters campaigns, the infrastructure on which the attacks have taken place is generic hosting, tied to no named group and absent from public feeds.
Reco is only confident that “one Go binary hit Salesforce over both Aura and LWR and hit ServiceNow, from the same box, which is most consistent with a single custom multi-platform toolset rather than anything off the shelf.”
How Can Users Stay Protected?
When it comes to remediation, Reco’s advice is to “work the guest user down to least privilege.”
This involves reviewing guest sharing rules to ensure that any rule that shares records with the Guest User beyond what the site genuinely has to serve to the public is removed. It also involves stripping object and field-level permissions, as well as the ‘Access Activities’ permission from guest profiles, and disabling self-registration unless absolutely necessary.
It has also been recommended to turn off guest access to the UI-API on LWR. This can be done by going into Experience Builder, then to Workspaces → Administration → Preferences and unchecking ‘Allow guest users to access public APIs’. More information can be found in this Salesforce Help page.
Summary
These attacks bring the pressing cybersecurity conversation back to the forefront of enterprise SaaS discussions, highlighting all the different ways threat actors can access sensitive data if appropriate permissions, guardrails, and security measures are not implemented.
Software frameworks and infrastructure are only one half of the issue here – human error is the other, which is why appropriate education and awareness of these attacks continue to remain important.
