Salesforce Warns of ShinyHunters Group Exploiting Experience Cloud Sites
A critical warning has been issued regarding an active threat campaign targeting misconfigured Experience Cloud sites.
A critical warning has been issued regarding an active threat campaign targeting misconfigured Experience Cloud sites.
The threat actor group ShinyHunters is responsible for a data theft operation exploiting overly permissive guest user configurations, reportedly impacting numerous organizations.
According to Salesforce's Cyber Security Operations Center, the campaign does not exploit a vulnerability within the Salesforce platform itself. Instead, it targets customer misconfigurations. In a typical Experience Cloud setup, a guest user profile grants unauthenticated visitors access to public-facing data. However, misconfigured profiles with excessive permissions can expose sensitive internal records.
The threat actors are scanning public sites using a modified version of Aura Inspector, an open-source tool initially developed for security auditing. While the standard tool identifies data exposure risks, ShinyHunters' custom version can actively extract data.
A critical warning has been issued regarding an active threat campaign targeting misconfigured Experience Cloud sites.
By probing specific exposed API endpoints, attackers can directly query Salesforce CRM objects without logging in to access sensitive information. ShinyHunters claims to have compromised numerous websites and companies. The stolen data, often including personal details, fuels follow-on targeted social engineering and voice phishing attacks. Additionally, the group employs extortion tactics, threatening to publish the data on dark web leak sites if ransoms are not paid.
Salesforce operates on a layered security model that includes object access, record access, field-level security, and field value masking. If any of these layers are configured too broadly for guest users, the entire chain is compromised. This allows attackers to bypass interface restrictions and access unmasked data directly from the backend database.
Salesforce advises administrators to adopt a least privilege access model to secure their environments. Key defensive actions include:
Disable Public APIs: Organizations should uncheck the setting allowing guest users to access public APIs, closing the targeted Aura endpoint to unauthenticated queries. Audit Guest Profiles: Review and restrict guest user access to the minimum objects and fields required for site functionality. Set Defaults to Private: Ensure the default for external object access is set to private, so guest users cannot view records without explicit sharing rules. Restrict Internal Visibility: Disable portal and site user visibility settings to prevent attackers from enumerating internal organization members. Disable Self-Registration: If public account creation is not necessary, turn it off to prevent attackers from escalating their access from a guest tier to an authenticated session.
Organizations using Salesforce Experience Cloud must act quickly to audit their environments. Properly securing guest user settings is critical to defending against this ongoing campaign.
Based on reporting by Cyber Security News.