Salesforce Indirect Prompt Injection Vulnerability Enables 0-click Data Exfiltration
Zenity disclosed SalesBleed, a patched Agentforce flaw enabling zero-click CRM theft via prompt injection.
Zenity Labs disclosed SalesBleed, a now-patched Salesforce Agentforce issue that could let attackers steal CRM data without logging in or any victim click. Hidden instructions in public Web-to-Lead submissions could later direct the agent, during a routine employee query, to read Account data such as company names and deal sizes. Exfiltration used an HTML image hostname that leaked values through DNS after malformed URLs bypassed Trusted URL redaction. Salesforce switched to standards-compliant URL parsing, and Zenity said it confirmed the fix in August.
- Indirect prompt injection arrived through public Web-to-Lead forms.
- Poisoned leads could make Agentforce query other CRM records.
- Encoded data could leak through DNS lookups for image hosts.
- Malformed URLs bypassed Trusted URL redaction; Salesforce patched it.
- Vendors
- Salesforce
- Products
- AgentforceWeb-to-Lead
- Organizations
- Zenity LabsSalesforce
From the original article
3 min read at cybersecuritynews.com
Zenity Labs disclosed a now-patched Salesforce Agentforce vulnerability, dubbed SalesBleed, that could have allowed attackers to steal sensitive CRM data without logging in, accessing a target Salesforce tenant, or requiring victim interaction. The attack relied on indirect prompt injection delivered through Salesforce Web-to-Lead forms.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.