Using ForceHound to Map Salesforce Privilege-Escalation Paths
Summary
A walkthrough shows how ForceHound loads Salesforce identity and entitlement data into BloodHound to map privilege-escalation paths, Connected App access, and object permissions, including legacy authorizations not addressed by Salesforce’s 2025 restrictions.
Key points
- ForceHound’s Aura mode collects Salesforce identity and entitlement data and uploads it to BloodHound for graph analysis.
- Queries can reveal paths where ManageUsers or AssignPermissionSets may let a user grant themselves ModifyAllData.
- The tool models non-admin-approved Connected Apps with CanAccessApp links from every profile; admin-approved apps require explicit grants.
- Cypher queries can map users’ access to Connected Apps, ApiEnabled, AuthorApex, and object-level CRUD permissions.
- Salesforce’s September 2025 Connected App installation restrictions improve protections for new integrations but do not remove legacy authorizations from existing orgs.
- ForceHound makes misconfigurations visible but does not remediate them.
Article Details
- Topic
- ForceHound uses BloodHound graph analysis to identify Salesforce privilege-escalation paths and Connected App authorization risks.
Products
Tools
BloodHoundForceHound extracts Salesforce identity and entitlement data and uploads it into BloodHound so defenders and attackers can query graph paths that reveal transitive privilege escalation and connectedâapp exposures.ForceHoundForceHound extracts Salesforce identity and entitlement data and uploads it into BloodHound so defenders and attackers can query graph paths that reveal transitive privilege escalation and connectedâapp exposures.SFHoundWhile working on this tool, the SFHound tool was released by Kaibersec.