Security Research Uncovers Vulnerability in Salesforce’s Agentforce
In a recent revelation, security researchers have identified a significant vulnerability chain dubbed “SalesBleed,” which is linked to Salesforce’s Agentforce. This vulnerability poses a grave threat as it allows attackers to extract sensitive customer relationship management (CRM) data via an indirect prompt injection embedded within a public Web-to-Lead form. This exploitation method does not necessitate a Salesforce login or direct interaction from the victim, granting attackers an unintended entry point to sensitive information through routine operations.
In investigating these findings, Salesforce has acknowledged the potential risks and undertaken measures to remediate the vulnerabilities reported. According to the detailed assessments, the chain of attack initiates with a nefarious submission made to a company’s public Salesforce Web-to-Lead endpoint. These endpoints, designed to be unauthenticated, enable prospective customers to submit their contact details easily, thus creating a vulnerability that malicious actors can exploit.
The mechanism of attack hinges on malicious instructions that an attacker embeds in a lead field. While these instructions might appear innocuous to the untrained eye, they are interpreted as actionable commands when Agentforce processes the associated record. Research indicates that these threat vectors can remain dormant within the CRM system until an internal employee queries Agentforce for recent leads, potentially triggering the data leak.
For instance, when a user requests Agentforce to “check my latest leads and help me with the newest one,” the embedded harmful payload can prompt the subagent to access other objects within the CRM, including the Accounts table. This subversion could lead to the unwanted retrieval of sensitive information such as account names and deal sizes.
Researchers have illustrated how the agent retrieves such data and encodes it into a domain controlled by the attacker. When the Agentforce chat interface generates an output resembling an HTML image tag, the underlying mechanism sends a DNS request to resolve the image’s hostname. Crucially, this resolution marks the point where the exposed data reaches the attacker’s authoritative DNS server, effectively leaking sensitive information. Notably, this theft can occur without the need for an HTTP request; as soon as the DNS resolution transpires, the data is out of the organization’s secure environment.
Further investigation unveiled that an attack path might also exist through integrations with platforms like Slack. In scenarios where Agentforce is deployed to Slack, an attacker’s controlled URL could utilize Slack’s automated link-preview feature to prompt DNS resolution automatically, thus amplifying the impact of this zero-click attack.
Researchers categorized this as a zero-click exploit since it requires no action from the employee other than a standard agent query, allowing the unauthorized data access and outbound DNS resolution to unfold transparently.
Salesforce had implemented its Trusted URLs mechanism as a safeguard, aimed at curtailing external destinations and supporting Content Security Policy controls for various resources. In light of the SalesBleed vulnerability, the company has reinforced these Trusted URL allowlists for Agentforce and its Einstein Generative AI agents, attempting a defense-in-depth strategy against outbound requests driven by prompt injections.
Analysis revealed that researchers successfully bypassed the URL redaction mechanisms by exploiting inconsistencies between how the URL redactor assessed URLs and the behavior of web browsers. By combining a top-level domain that the redactor failed to identify and specific termination characters, the malicious input was not flagged as harmful. Thus, while the redactor processed it as malformed, the browser still attempted hostname resolution, leaving the door open for exploitation.
This scenario underscores a troubling trend in AI security where externally supplied content, expansive tool permissions, and outbound communication channels coexist under a single agent identity. In this context, the prompt injection was not reliant on privilege escalation but instead misused the existing data access afforded to the CRM subagent.
The broader implications of this vulnerability hinge on the objects and fields accessible through Agentforce tools. In configurations vulnerable to exploitation, an attacker might have the capacity to retrieve critical information pertaining to accounts, contacts, pipelines, and other records retrieved through the agent.
The persistence of compromised lead records raises another layer of concern, as a single malicious submission can trigger the data leakage repeatedly whenever staff inquiries about that lead occur. Salesforce has expressed that it has bolstered the affected mechanisms, with reports indicating no evidence of exploitation occurring in the wild. Furthermore, the company has modified default settings related to certain Agentforce actions in Slack to necessitate user confirmation before messages are disseminated.
Recommended Mitigation Steps
Organizations employing Agentforce are urged to implement several critical mitigation strategies:
- Review Public Web-to-Lead Forms: Treat all submitted fields as untrusted AI inputs.
- Apply Least Privilege: Ensure that Agentforce subagents operate with minimum access, separating lead review functionalities from sensitive account and contact information.
- Audit Trusted URL Allowlists: Be cautious of overly broad wildcard entries that may expose vulnerabilities.
- Sanitize HTML Content in Responses: Restrict or sanitize HTML and outside resolved content in responses generated by agents.
- Monitor DNS Telemetry: Keep an eye on DNS activity for any unusual high-entropy or data-like subdomains.
- Enable Prompt-Injection Detection: Activate available detection mechanisms and review relevant reports and dashboards.
- Require User Confirmation for Actions: Particularly for significant actions, including Slack messages and external requests.
This situation serves as a critical reminder that relying solely on output filtering may not offer sufficient protection against sophisticated vulnerabilities, highlighting the need for comprehensive security practices.