Overly permissive ‘guest’ settings put Salesforce customers at risk

Source: Overly permissive ‘guest’ settings put Salesforce customers at risk | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4143667/overly-permissive-guest-settings-put-salesforce-customers-at-risk.html

ONE SENTENCE SUMMARY:

Salesforce warns ShinyHunters is mass-scanning misconfigured Experience Cloud guest access to steal exposed CRM data for extortion.

MAIN POINTS:

  1. Salesforce urged customers to review Experience Cloud “guest” configurations after active data-theft reports.
  2. ShinyHunters claims breaches across hundreds of organizations, including 400 websites and 100 high-profile companies.
  3. Campaign targets misconfigured public portals, not underlying Salesforce platform vulnerabilities.
  4. Salesforce CSOC observed a known threat actor scanning public Experience Cloud sites at scale.
  5. Attackers leverage a modified Aura Inspector tool to probe and extract accessible data.
  6. Exploitation focuses on the “/s/sfsites/aura” API endpoint exposed by Experience Cloud sites.
  7. Overly permissive guest profiles can allow direct querying of backend CRM objects without credentials.
  8. Advisory highlights three risky conditions enabling unauthorized data access through guest profiles.
  9. Salesforce environments attract attackers due to sensitive data and complex layered permission models.
  10. Recommended mitigations include auditing guest permissions, limiting APIs, restricting object visibility, and least privilege.

TAKEAWAYS:

  1. Misconfiguration, especially guest access, can expose significant Salesforce data without any exploit.
  2. Automated scanning tools make public Experience Cloud portals high-risk if permissions are lax.
  3. Three controls matter most: guest permissions, private external defaults, and disabling public APIs.
  4. Complex Salesforce access models and integrations increase accidental exposure and blast radius.
  5. Hardening requires continuous auditing and strict least-privilege enforcement across portals and APIs.