Salesforce warns hackers targeting websites running misconfigured Experience Cloud platforms

Salesforce has warned customers that hackers are targeting websites running misconfigured Experience Cloud platforms that may allow guest users to access more data than intended. Meanwhile, the ShinyHunters extortion group claims it is actively exploiting a newly discovered vulnerability to steal data from affected instances.

To help customers protect themselves, Salesforce has issued guidance on defending against attacks focused on the /s/sfsites/aura API endpoint in misconfigured Experience Cloud deployments. According to the company, attackers are using a modified version of AuraInspector, an open-source auditing tool developed by Mandiant, which helps administrators detect access-control misconfigurations within the Salesforce Aura framework.

"It is important to note that Salesforce remains secure, and this issue is not due to any vulnerability inherent to our platform. Our investigation to date confirms that this activity relates to a customer-configured guest user setting, not a platform security flaw," Salesforce says in the advisory.

The company explains that a publicly exposed Salesforce Experience site accepts a "guest user profile" to provide anonymous, unauthenticated visitors with access to data intended to be public. If the profile is misconfigured and has excessive permissions, visitors can "directly query Salesforce CRM objects without logging in."

The company recommends customers take the following set of immediate actions:

·         Audit guest user permissions and reduce them to the minimum required.

·         Set org-wide defaults to Private for external access.

·         Turn off Portal User Visibility and Site User Visibility so guest users cannot enumerate internal users.

·         Disable self-registration unless it is truly needed, because exposed guest data could be used to create portal accounts and expand access.

System administrators should also review Aura Event Monitoring logs for unusual access patterns, unfamiliar IP addresses, or queries against objects that should not be public, and designate a Security Contact so Salesforce can notify the right person quickly.