Agentforce flaws let a poisoned web lead leak CRM data over DNS

Zenity Labs on 24 September published details of three flaws in Salesforce Agentforce, which it calls SalesBleed, that let an attacker pull restricted customer relationship management (CRM) records out of a customer’s instance by submitting one Web-to-Lead form.

Web-to-Lead endpoints are public by design. The attacker files a lead that carries instructions in one field. Nothing happens until a sales user asks the agent to review the latest leads. The agent reads the poisoned record, follows its instructions, pulls company names and deal sizes from the Accounts table through its Query Records tool and writes them into the subdomain of a URL. Rendered as an image tag or unfurled by Slack, that URL triggers a Domain Name System (DNS) lookup the attacker’s nameserver records. Salesforce’s Trusted URLs control should have redacted the link, but it did not recognize the .fun top-level domain and disagreed with browsers about where a URL ends, so curly braces and square brackets carried it through.

A default agent with too much reach

The injection could reach account data because the stock General CRM subagent ships with read access to both leads and accounts. The third flaw let the agent’s Slack integration post phishing messages under the agent’s own trusted identity.

Zenity reported the findings on 1 June and Salesforce confirmed its fixes on 18 August. A Salesforce spokesperson told SecurityWeek the company had “no evidence at this time that the reported issue was exploited against any customer” and that certain Agentforce actions in Slack now require user confirmation by default. Zenity, which sells agent security software, argues the same mix of untrusted input, broad permissions and rendered links exists beyond Salesforce, as Digit reported on 28 September.