Salesforce Agentforce Vulnerabilities Allowed Zero-Click Data Exfiltration and Phishing

SalesBleed Vulnerabilities Discovered

Zenity Labs reported three vulnerabilities in Salesforce Agentforce, collectively named SalesBleed. These security flaws could have allowed attackers to compromise trusted agents within Salesforce for unauthorized data exfiltration and phishing activities. The vulnerabilities were exploitable through Salesforce’s official lead-collection mechanism, Web-to-Lead forms.

Zero-Click Data Exfiltration

Two of the SalesBleed bugs facilitated zero-click data exfiltration. Malicious instructions injected into a Web-to-Lead form would remain dormant until an Agentforce agent processed the submission. This process caused the agent to execute the hidden instructions, leading to the exfiltration of sensitive CRM data, such as leads and accounts table data, to an attacker's server using HTML image tags. The system reported content as blocked, but data had already been transmitted.

Bypassing Trusted URLs

The first two flaws stemmed from weaknesses in Agentforce's Trusted URLs security mechanism. This mechanism is designed to prevent the display of content from untrusted sources. However, Zenity Labs found that Trusted URLs did not recognize top-level domains and was susceptible to URL parsing tampering through specific character sequences, allowing attackers to bypass its intended protections.

Phishing via Slack Integration

The third vulnerability affected the Agentforce-Slack integration. Attackers could use a poisoned Web-to-Lead mechanism to interact with the Agentforce agent via Slack. Specially constructed links could cause Slack to initiate requests that carried CRM data to attacker-controlled infrastructure. Additionally, this flaw allowed attackers to hijack the Agentforce agent's identity to post phishing messages to internal Slack channels, leveraging the agent's trusted status to deceive employees.