Three vulnerabilities in Salesforce Agentforce could have allowed attackers to hijack trusted agents for sensitive CRM data exfiltration and phishing, Zenity Labs reports.
Dubbed SalesBleed, the flaws could be exploited via Web-to-Lead forms, Salesforce’s official lead-collection mechanism, which also provides a direct path to the CRM.
Malicious instructions injected into a Web-to-Lead lead would remain dormant until an employee asks an Agentforce agent to interact with the submission, causing the agent to process the poisoned lead and execute the hidden instructions.
According to Zenity Labs, two of the SalesBleed bugs could be exploited in zero-click data exfiltration attacks, while the third allowed attackers to weaponize an Agentforce agent to distribute phishing messages.
The first two flaws were caused by multiple weaknesses in Trusted URLs, the security mechanism designed to block Agentforce from displaying URLs and images from untrusted sources. The third affects the Agentforce-Slack integration.
Zenity Labs discovered that a Web-to-Lead form payload could be used to access leads and accounts table data and then use HTML image tags for zero-click CRM data exfiltration to the attacker’s server.
“Agentforce reported that the content had been blocked by the organization’s security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server,” the company notes.
While Trusted URLs should prevent Agentforce from accessing and sending data to unapproved domains, Zenity Labs discovered that the mechanism did not recognize top-level domains and that character sequences could tamper with URL parsing.