Critical Salesforce Bug Lets Attackers Steal Data via Prompt Injection

Key Takeaways

• A critical vulnerability, dubbed SalesBleed, was discovered in Salesforce’s Agentforce, allowing unauthorized data exfiltration.
• The flaw exploited indirect prompt injection via public Web-to-Lead forms, enabling attackers to steal sensitive CRM data, including account records.
• The attack was zero-click, requiring no user interaction beyond an employee asking Agentforce a routine question.
• Salesforce has patched the specific Trusted URLs bypass identified by researchers, and broader SalesBleed issues are also reported as fixed.

Security researchers at Zenity Labs have uncovered and disclosed a significant vulnerability within Salesforce’s Agentforce platform, now patched, which they named SalesBleed. This flaw could have allowed attackers to illicitly extract sensitive customer relationship management (CRM) data without needing to log in, access a specific Salesforce tenant, or require any direct interaction from a victim.

The Mechanics of SalesBleed: Indirect Prompt Injection

The core of the SalesBleed attack vector lay in an indirect prompt injection technique, facilitated through Salesforce’s ubiquitous Web-to-Lead forms. These forms are designed as public-facing gateways for external users to submit sales inquiries and potential leads directly into a company’s Salesforce instance.

Attackers could submit seemingly legitimate lead information, subtly embedding hidden, malicious instructions within a field. This “poisoned” data would then be stored within the organization’s Leads table. Later, if an employee used Agentforce—Salesforce’s AI assistant—to perform a routine task, such as reviewing recent leads, the AI agent could inadvertently process the malicious record. Salesforce has since investigated these reports and implemented remediations for the specific Trusted URLs bypass that Zenity leveraged in their research.

Zenity confirmed the effectiveness of the fix in August, with subsequent reports indicating that the broader vulnerabilities associated with SalesBleed have also been addressed by Salesforce.

Data Exfiltration Without Privilege Escalation

According to research detailed by Zenity found, the injected instructions were capable of directing Agentforce’s General CRM subagent to utilize its existing “Query Records” functionality. This allowed the subagent to access other sensitive CRM data beyond just lead information, specifically including Account records. Crucially, this attack did not necessitate any form of privilege escalation because the subagent already possessed legitimate access to both lead and account data within its operational scope.

The attacker could issue commands instructing the agent to retrieve specific values, such as company names or deal sizes. This information could then be embedded into a subdomain of a URL controlled by the attacker. This sophisticated method transformed a straightforward AI prompt injection into a potential chain for cross-record data access and exfiltration.

Zero-Click Data Theft via DNS Lookup

The method for data exfiltration leveraged an HTML image tag generated and returned by the Agentforce client. When the client rendered an external image source, the browser would attempt to resolve and fetch the hostname provided. An attacker-controlled hostname could contain encoded CRM data within its subdomain. Before initiating an HTTP request, the client’s system would perform a DNS lookup for this hostname. This DNS query could then be directed to an authoritative DNS server controlled by the attacker, allowing them to capture the sensitive data embedded within the hostname.

This technique is classified as zero-click because an employee’s only action was to ask the AI agent a routine question about leads. The user was not required to open any attachments, click on a URL, approve an action, or directly interact with the malicious lead record in any way that would raise suspicion.

Bypassing Trusted URL Protections

Salesforce Agentforce employs “Trusted URLs” as a critical security mechanism, functioning as an allowlist and redaction layer. Its purpose is to prevent agents from generating or accessing unauthorized external URLs. Salesforce documentation explicitly states that any unapproved URLs found in agent responses are replaced with “URL_Redacted.”

Zenity found specific edge cases within this URL-redaction logic. The researchers discovered that the control mechanism inconsistently recognized certain top-level domains and handled particular special characters differently compared to the downstream components responsible for rendering the URLs. This discrepancy meant that a malformed string could bypass the redaction process while still being interpreted as a fetchable URL when placed within an HTML image source tag.

Reports indicate that Salesforce has since replaced its previous regex-based approach to URL identification with a more robust, standards-compliant URL parsing method. This change directly addresses the bypass conditions identified by the researchers, thereby mitigating the vulnerability.

What You Should Do

• Review Agentforce Permissions: Conduct a thorough audit of all Agentforce tool permissions. Ensure that agents are granted access only to the absolute minimum CRM objects and data necessary for their intended functions (principle of least privilege).
• Strict Trusted URL Allowlisting: Implement and rigorously enforce narrowly scoped Trusted URL allowlists. Regularly review and update these lists to ensure they only permit access to essential and verified external resources.
• Treat External Data as Untrusted: Adopt a security posture that treats all externally submitted CRM fields, especially those from public forms like Web-to-Lead, as inherently untrusted instructions rather than trusted business content. Implement robust validation and sanitization for all such inputs.
• Stay Updated: Ensure all Salesforce instances and related components are kept fully updated with the latest security patches and configurations provided by Salesforce.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.