AuraAudit – Open-Source Tool for Salesforce Aura Framework Misconfiguration Analysis
Mandiant has introduced AuraInspector, an open-source command-line tool designed to help security professionals identify and audit access-control misconfigurations within the Salesforce Aura framework.
Mandiant has introduced AuraInspector, an open-source command-line tool designed to help security professionals identify and audit access-control misconfigurations within the Salesforce Aura framework.
This tool addresses a significant security vulnerability in Salesforce Experience Cloud deployments, where configuration errors can expose sensitive information such as credit card numbers, identity documents, and health data.
The Aura endpoint, a key component of Salesforce's Lightning Experience interface, is a frequent target for attacks in Experience Cloud applications.
Salesforce's object sharing rules are complex, spanning multiple configuration levels, which makes detecting access-control misconfigurations challenging for administrators.
AuraInspector automates the process of identifying these vulnerabilities and provides actionable remediation guidance.
The tool utilizes several attack techniques previously documented by Mandiant’s Offensive Security Services team.
Automatic Aura Detection: Automatically locates the Aura endpoint. Object Access Scan: Checks which objects and records are accessible. Record List Discovery: Identifies exposed record lists and their URLs. Self-Registration Check: Evaluates if self-signup is enabled and retrieves signup links. URL Discovery: Automatically finds home and admin URLs. GraphQL Bypass: Utilizes a GraphQL method to fetch more than 2,000 records. Action Bulking: Sends multiple actions in one request. Read-Only Mode: Operates in read-only mode to ensure no data modifications. Command-Line Tool: Features a simple CLI for scanning and reporting. Open Source: Available on GitHub .
The Aura endpoint, a key component of Salesforce's Lightning Experience interface, is a frequent target for attacks in Experience Cloud applications.
AuraInspector identifies accessible objects through Aura methods such as getItems and getConfigData , which can reveal sensitive records if access controls are improperly configured.
The tool also scans for exposed Record Lists, which are Salesforce components that can provide direct access to object records when permissions are misconfigured.
A significant capability of AuraInspector is its ability to detect enabled self-registration endpoints.
Instances have been observed where self-registration links were removed from login pages but the functionality remained active, allowing unauthorized account creation.
AuraInspector introduces a new technique using Salesforce's GraphQL Aura controller to bypass the standard 2,000-record retrieval limit.
This feature allows for a comprehensive assessment of the misconfiguration impact without requiring manual sorting workarounds.
The tool automates the construction of GraphQL queries to retrieve complete datasets when access controls fail.
AuraInspector automatically discovers essential contextual information, including Aura endpoints, home and record list URLs, self-registration status, and accessible administration panels.
It performs strictly read-only operations, ensuring that tested instances remain unmodified. It is recommended that administrators audit guest user permissions following the principle of least privilege.
Review sharing rules and organization-wide defaults, disable unnecessary self-registration, and implement Salesforce security best practices. The Security Health Check tool and the comprehensive Salesforce Security Guide provide additional guidance for enhancing security.
AuraInspector is now available on GitHub, enabling security teams to proactively identify and address Aura-related vulnerabilities before they can be exploited by adversaries.
Based on reporting by Cyber Security News.