Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection
Zenity's SalesBleed shows a zero-click Agentforce prompt injection that can leak Salesforce CRM data via DNS.
Zenity Labs disclosed SalesBleed, an indirect prompt-injection chain against Salesforce Agentforce that needs no Salesforce login or victim click. An attacker plants instructions in a public Web-to-Lead submission; when an employee later asks the agent to review leads, those instructions can drive the CRM subagent to query records such as account names and deal sizes. The proof of concept encodes the data in an attacker-controlled hostname inside an image URL so a DNS lookup exposes it, including through Slack link previews in some deployments. Salesforce said it strengthened the affected controls, changed some Slack defaults to require confirmation, and reported no evidence of exploitation in the wild.
- Malicious instructions are stored through a public, unauthenticated Web-to-Lead form.
- A normal employee request can cause Agentforce to query other CRM records.
- Encoded data can leave through DNS when the chat client renders an image URL.
- Researchers bypassed URL redaction using parser and browser differences.
- Salesforce says the issue was remediated and not seen exploited in the wild.
- Vendors
- Salesforce
- Products
- AgentforceWeb-to-LeadSlack
- Organizations
- Zenity Labs
From the original article
3 min read at gbhackers.com
Security researchers have revealed a vulnerability chain known as “SalesBleed,” associated with Salesforce’s Agentforce. This vulnerability could allow attackers to extract sensitive CRM data through an indirect prompt injection embedded in a public Web-to-Lead form. The attack does not require a Salesforce login or a click from the victim and could leak data via DNS […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.