Salesforce Agentforce Flaws Could Expose Data and Enable Phishing in Slack
Summary
Researchers found Agentforce flaws that could let attackers inject prompts through Web-to-lead forms, expose customer data, and send convincing phishing messages in Slack. Salesforce updated URL inspection and made some Slack actions require confirmation.
Key points
- Zenity researchers identified three Agentforce weaknesses, collectively called “Salesbleed.”
- Attackers could inject instructions through Salesforce Web-to-lead forms and exploit agents’ permissions to access or exfiltrate internal data.
- When agents are deployed in Slack, injected prompts could make them post phishing messages in internal threads, potentially appearing to come from a real employee or help desk.
- The researchers said Slack message replies lacked confirmation and attribution controls available for other agent actions.
- Salesforce said it has no evidence of real-world exploitation and updated default settings so certain Slack actions require user confirmation.
- Salesforce replaced regex-based URL checks with spec-conformant parsing and centralized URL inspection through a single gateway.
Article Details
- Vulnerability Types
- Web-to-lead prompt injection that can cause Agentforce agents to exfiltrate data
- Missing user confirmation and attribution controls for Agentforce agents replying to Slack threads, enabling phishing messages
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Require user confirmation before Agentforce actions in Slack send messages.
- Review Agentforce configurations and make Salesforce's recommended changes.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterAn Agentforce agent processes an attacker-supplied prompt in a Web-to-lead form and executes the requested action.T1534 · Internal SpearphishingAn attacker can induce an Agentforce bot to post a phishing message in an internal company Slack thread.T1566 · PhishingAn induced Slack thread reply could impersonate an employee or IT help desk and carry a phishing link.T1567 · Exfiltration Over Web ServiceThe prompt can instruct an Agentforce agent to exfiltrate data to an attacker-controlled URL.
People
Vendors
Products
AgentforceVulnerabilities in Salesforce Agentforce, collectively dubbed "Salesbleed" by researchers, could expose customers' internal data and, worse, allow attackers to phish employees from within trusted company channels.Slackbe combined with normal Agentforce workflows to ultimately phish employees from within their most trusted Slack channels.