Reco Demonstrates LLM Agent Finding and Exploiting Salesforce Experience Cloud Flaws
Summary
Reco reports that its autonomous agent found and exploited access-control and SOQL injection flaws in Salesforce Experience Cloud sites, exposing personal data and confidential files. The affected organizations were given fictional names, and the findings were disclosed
Key points
- Reco says its agent mapped Salesforce Experience Cloud objects, Apex methods, routes, and files starting from a site URL.
- In the Aegis Security case study, the agent found a guest-accessible method exposing Contact and Account data, plus confidential partner documents.
- In the Helios case study, the agent exploited blind SOQL injection to extract employee and customer information.
- Reco reports that the agent also found a customer syslog export containing personal data, authentication history, session IDs, and partial token values.
- The article attributes the findings to broken access controls, exposed guest access, and unsafe dynamic SOQL query construction; the organization names are fictional.
- Reco says the vulnerabilities were responsibly disclosed and recommends reviewing guest-user permissions, Apex sharing settings, file visibility, and SOQL bind-variable use.
Article Details
- Attack Vectors
- Unauthenticated access to an exposed Salesforce Apex method returned Contact and linked Account data.
- Dynamic SOQL built through string concatenation allowed blind injection through a blogId parameter and extraction of employee and customer records.
- Guest-accessible ContentDocument objects and file settings exposed confidential documents and customer security-audit data for download.
- An autonomous assessment agent enumerated exposed Salesforce objects, Apex methods, routes, and files, then tested methods and generated and ran proof-of-concept exploits.
- Defensive Notes
- Review guest-user permissions, Apex method access, sharing rules, and ContentDocument visibility on Salesforce Experience Cloud sites.
- Use bind variables in dynamic SOQL rather than concatenating user-controlled input.
- Review Apex classes configured with “without sharing” and use that mode only when necessary.
- Include Salesforce sites and portals in security audits and vulnerability disclosure programs; do not rely on obscurity to protect methods, routes, or files.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe agent exploited a guest-accessible Apex method and a blind SOQL injection in BlogDetailController.getFeedDetails on Salesforce Experience Cloud sites.T1213 · Data from Information RepositoriesThe agent queried Salesforce objects and retrieved records, including Contact, Lead, and User data, through exposed guest-accessible functionality.T1530 · Data from Cloud StorageThe agent enumerated and downloaded files exposed through Salesforce ContentDocument access, including documents identified as confidential.T1595 · Active ScanningThe assessment agent queried Salesforce Aura to enumerate publicly accessible objects, Apex methods, routes, and content from a site URL.
Threat Actors
Vendors
Products
Salesforce AuraIt queries the Salesforce Aura framework to enumerate all accessible Salesforce objects (database tables), Apex controller methods (server-side business logic), routes (public pages), and content (files and documents).Salesforce Experience CloudAI-powered agents are now able to autonomously map Salesforce Experience Cloud attack surfaces, identify vulnerabilities, write exploits, and extract sensitive data without human guidance.
Tools
Industries
CybersecurityCompany profile: Aegis Security (name changed) is a major cybersecurity vendor with a partner portal built on Salesforce Experience Cloud.Financial ServicesOne of the extracted Contact records belonged to a customer at a major financial services firm – full name, corporate email, and direct phone number.TechnologyWe pointed it at real-world Salesforce sites belonging to major technology companies, and the results were sobering.